CySA+ Test CySA+ Test Malware Analysis 1

Question 1

Which malware analysis technique executes a sample in an isolated environment to observe its behavior without risking production systems?

Accepted Answer

Dynamic analysis

Answer

Dynamic analysis runs malware in a sandbox to observe runtime behavior such as file writes, network calls, and registry changes.

Question 2

A CySA+ analyst uses a disassembler to examine malware without executing it. This is an example of which analysis type?

Accepted Answer

Static analysis

Answer

Static analysis inspects malware code, strings, and structure without running it, often using tools like disassemblers and hex editors.

Question 3

Which indicator would BEST suggest a piece of malware is performing process injection?

Accepted Answer

Unexpected DLL loaded in a legitimate process memory space

Answer

Process injection is characterized by a foreign DLL or code being loaded into a legitimate process's memory space to evade detection.

Question 4

Which type of malware is specifically designed to record keystrokes and transmit them to an attacker?

Accepted Answer

Keylogger

Answer

A keylogger captures and logs keyboard input, often to steal credentials or sensitive information.

Question 5

An analyst identifies malware that modifies the Master Boot Record (MBR). Which malware classification BEST fits this behavior?

Accepted Answer

Bootkit

Answer

A bootkit infects the MBR or boot sector, loading before the OS and persisting across reboots.

CySA+ Practice Test