Malware Analysis (CySA+): Static vs Dynamic Methods

1. What is the primary advantage of dynamic malware analysis?

Faster than static analysis

Observes actual runtime behavior and system interactions

Does not require any tools

Always identifies encrypted code

2. Which malware analysis approach examines code without executing it?

Static analysis

Dynamic analysis

Behavioral analysis

Sandbox testing

3. Which approach involves monitoring system calls, file modifications, and API invocations in real-time?

Static disassembly

Dynamic behavioral analysis

Signature matching

Hash verification

4. True or False: Dynamic analysis always requires executing malware in an isolated environment.

True

False

5. What does a sandbox provide during dynamic malware analysis?

Code decompilation

Isolated execution environment

Binary obfuscation

Encryption decryption

6. True or False: Combining static and dynamic analysis provides more comprehensive malware detection.

True

False

Submit

8. True or False: Polymorphic malware can easily evade static signature-based detection.

True

False

9. What is a key limitation of static analysis with obfuscated malware?

It requires internet connectivity

Code readability and understanding are severely reduced

It can only detect viruses

It modifies the original executable

10. Which malware behavior is best observed through dynamic analysis?

Variable declarations

Command and control server connections

Function naming

Code comments

11. Which approach would best detect a rootkit that hides its presence?

File signature scanning only

Dynamic analysis in a controlled environment

Static code review

Firewall inspection

12. True or False: Static analysis is always sufficient to detect all types of malware.

True

False

13. True or False: Zero-day malware with no known signatures can only be detected through dynamic analysis.

True

False

Submit

15. Which static analysis technique involves examining code structure without running it?

Memory forensics

Network traffic analysis

Reverse engineering

API monitoring

Submit

17. What does YARA help security analysts accomplish during static analysis?

Monitor process execution

Create rules to identify malware patterns

Decrypt encrypted files

Analyze network packets

Submit

20. Which tool is commonly used for disassembly during static analysis?

Wireshark

IDA Pro

Cuckoo Sandbox

Process Explorer

Malware Analysis Quiz: Static or Dynamic?

1. What is the primary advantage of dynamic malware analysis?

2.

What first name or nickname would you like us to use?

2. Which malware analysis approach examines code without executing it?

3. Which approach involves monitoring system calls, file modifications, and API invocations in real-time?

4. True or False: Dynamic analysis always requires executing malware in an isolated environment.

5. What does a sandbox provide during dynamic malware analysis?

6. True or False: Combining static and dynamic analysis provides more comprehensive malware detection.

7. Cuckoo Sandbox is primarily used for ____ malware analysis.

8. True or False: Polymorphic malware can easily evade static signature-based detection.

9. What is a key limitation of static analysis with obfuscated malware?

10. Which malware behavior is best observed through dynamic analysis?

11. Which approach would best detect a rootkit that hides its presence?

12. True or False: Static analysis is always sufficient to detect all types of malware.

13. True or False: Zero-day malware with no known signatures can only be detected through dynamic analysis.

14. Packed or encrypted malware often requires ____ analysis to reveal its true functionality.

15. Which static analysis technique involves examining code structure without running it?

16. Static analysis can identify malware by examining ____.

17. What does YARA help security analysts accomplish during static analysis?

18. Dynamic analysis monitors malware behavior through system calls, registry access, and ____.

19. A malware analyst uses IDA Pro to examine assembly code and identify suspicious functions. This is an example of ____ analysis.

20. Which tool is commonly used for disassembly during static analysis?