20+ practice questions focused on Cryptography and Malware Analysis — one of the most tested topics on the Certified Ethical Hacker CEH exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Cryptography and Malware Analysis PracticeWhich THREE of the following are types of cryptanalytic attacks? (Choose three.)
Explanation: Cryptanalytic attacks aim to find weaknesses in cryptographic algorithms to recover plaintext or keys. Differential cryptanalysis (A) and Linear cryptanalysis (C) are sophisticated techniques that exploit statistical properties and mathematical structures of ciphers, particularly block ciphers, to deduce the key. A brute-force attack (D) is a fundamental cryptanalytic method that involves systematically trying every possible key until the correct one is found, directly targeting the cipher's key space. Rainbow table attacks (B) target password hashes, not the underlying cipher, and replay attacks (E) are protocol-level attacks, not cryptanalytic.
A malware analyst is investigating a suspicious executable that appears to be a Trojan. The analyst runs the executable in a sandbox and observes the following behavior: it creates a hidden file in the %AppData% directory, modifies the Windows registry to add a startup entry, and attempts to connect to an external IP address on port 443 using HTTPS. Which TWO of the following techniques are likely being used by this malware?
Explanation: The malware adds a startup entry in the Windows registry (e.g., Run or RunOnce keys), which ensures the executable is automatically launched each time the user logs in. This is a classic persistence mechanism, as defined by MITRE ATT&CK technique T1547.003, because it maintains the malware's presence across system reboots. Additionally, the attempt to connect to an external IP address on port 443 using HTTPS indicates command and control (C2) communication, where the malware establishes a channel to receive commands from its operator or exfiltrate data.
Refer to the exhibit. A security analyst runs netstat on a compromised Windows machine. Based on the output, which process is most likely associated with the malicious activity?
Explanation: Netstat output showing a suspicious external connection (e.g., to an unknown IP on port 4444) associated with PID 1234, which is identified as explorer.exe, indicates that the Windows shell process has been hijacked or injected with malicious code. Explorer.exe is not a typical network-listening process; its involvement in outbound connections to a non-standard port strongly suggests malware has injected a reverse shell or beacon into this legitimate system process to evade detection.
Drag and drop the steps to configure a wireless network with WPA2-Enterprise authentication on a Cisco AP into the correct order.
Explanation: The explanation states: 'creating the WLAN on the controller with the RADIUS settings, followed by configuring the AP to use that RADIUS server.' If the WLAN is created *with* the RADIUS settings (meaning the RADIUS server is specified during WLAN creation on the controller), then the APs managed by that controller will automatically use those settings. A separate, subsequent step to 'configure the AP to use that RADIUS server' is redundant or misplaced in this context. The explanation should provide a consistent and accurate sequence that clearly justifies the chosen answer, for example: 'The correct sequence for configuring WPA2-Enterprise on a Cisco AP begins with setting up the RADIUS server to handle authentication. Next, create the WLAN (defining its SSID and security type as WPA2-Enterprise). Then, configure the AP to use the RADIUS server by specifying its details within the WLAN's security settings. After that, enable the WLAN, and finally, test connectivity to ensure everything works. This order ensures dependencies are met and avoids misconfiguration.'
A security analyst is examining a suspicious executable recovered from a compromised workstation. Static analysis reveals that the file is packed with a commercial packer. The analyst wants to observe the malware's runtime behavior and extract the original unpacked code from memory without allowing the malware to communicate with its command-and-control (C2) server. Which approach is most appropriate?
Explanation: Dynamic analysis in a controlled sandbox with network simulation allows the packed malware to unpack itself in memory while preventing C2 communication. Memory dumping then extracts the unpacked payload for further static analysis. This method is both safe and effective, avoiding the risks of running the malware on a production network or the limitations of purely static techniques.
+15 more Cryptography and Malware Analysis questions available
Practice all Cryptography and Malware Analysis questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Cryptography and Malware Analysis. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Cryptography and Malware Analysis questions on the CEH frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Cryptography and Malware Analysis is tested as part of the Certified Ethical Hacker CEH blueprint. Practicing with targeted Cryptography and Malware Analysis questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CEH practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Cryptography and Malware Analysis is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Cryptography and Malware Analysis practice session with instant scoring and detailed explanations.
Start Cryptography and Malware Analysis Practice →