20+ practice questions focused on Cryptography and Malware Analysis — one of the most tested topics on the Certified Ethical Hacker CEH exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Cryptography and Malware Analysis PracticeWhich THREE of the following are types of cryptanalytic attacks? (Choose three.)
Explanation: Cryptanalytic attacks aim to find weaknesses in cryptographic algorithms to recover plaintext or keys. Differential cryptanalysis (A) and Linear cryptanalysis (C) are sophisticated techniques that exploit statistical properties and mathematical structures of ciphers, particularly block ciphers, to deduce the key. A brute-force attack (D) is a fundamental cryptanalytic method that involves systematically trying every possible key until the correct one is found, directly targeting the cipher's key space. Rainbow table attacks (B) target password hashes, not the underlying cipher, and replay attacks (E) are protocol-level attacks, not cryptanalytic.
A malware analyst is investigating a suspicious executable that appears to be a Trojan. The analyst runs the executable in a sandbox and observes the following behavior: it creates a hidden file in the %AppData% directory, modifies the Windows registry to add a startup entry, and attempts to connect to an external IP address on port 443 using HTTPS. Which TWO of the following techniques are likely being used by this malware?
Explanation: The malware adds a startup entry in the Windows registry (e.g., Run or RunOnce keys), which ensures the executable is automatically launched each time the user logs in. This is a classic persistence mechanism, as defined by MITRE ATT&CK technique T1547.003, because it maintains the malware's presence across system reboots. Additionally, the attempt to connect to an external IP address on port 443 using HTTPS indicates command and control (C2) communication, where the malware establishes a channel to receive commands from its operator or exfiltrate data.
Refer to the exhibit. A security analyst runs netstat on a compromised Windows machine. Based on the output, which process is most likely associated with the malicious activity?
Explanation: Netstat output showing a suspicious external connection (e.g., to an unknown IP on port 4444) associated with PID 1234, which is identified as explorer.exe, indicates that the Windows shell process has been hijacked or injected with malicious code. Explorer.exe is not a typical network-listening process; its involvement in outbound connections to a non-standard port strongly suggests malware has injected a reverse shell or beacon into this legitimate system process to evade detection.
You are a security analyst for a financial institution. The company has deployed a network of 500 Windows 10 workstations and 50 servers running Windows Server 2019. All systems are protected by a next-generation firewall and an endpoint detection and response (EDR) solution. Recently, several employees reported that their workstations are running slowly and exhibiting unusual pop-up messages demanding a ransom note in Bitcoin. The EDR alerts show that a file named 'invoice.docm' was downloaded from an email attachment and executed on multiple workstations. The EDR also indicates that the file dropped a PowerShell script that connected to an external IP address and downloaded additional payloads. After the initial infection, the EDR detected that the ransomware binary 'encryptor.exe' was executed, which began encrypting files. However, the encryption process was stopped by the EDR before all files were encrypted. The incident response team needs to determine the source of the infection and prevent future occurrences. Which of the following is the most effective first step to identify the initial infection vector?
Explanation: The incident response team needs to identify the initial infection vector first. Reviewing email logs for the original phishing email containing 'invoice.docm' is a forensic step that identifies the source. Reimaging removes the malware but also erases evidence; however, reviewing email logs before or after reimaging (as stated) allows identification of the vector, making this the most effective first step for identification. Options B, C, and D are containment or prevention measures that do not help identify the original infection vector.
Drag and drop the steps to configure a wireless network with WPA2-Enterprise authentication on a Cisco AP into the correct order.
Explanation: The explanation states: 'creating the WLAN on the controller with the RADIUS settings, followed by configuring the AP to use that RADIUS server.' If the WLAN is created *with* the RADIUS settings (meaning the RADIUS server is specified during WLAN creation on the controller), then the APs managed by that controller will automatically use those settings. A separate, subsequent step to 'configure the AP to use that RADIUS server' is redundant or misplaced in this context. The explanation should provide a consistent and accurate sequence that clearly justifies the chosen answer, for example: 'The correct sequence for configuring WPA2-Enterprise on a Cisco AP begins with setting up the RADIUS server to handle authentication. Next, create the WLAN (defining its SSID and security type as WPA2-Enterprise). Then, configure the AP to use the RADIUS server by specifying its details within the WLAN's security settings. After that, enable the WLAN, and finally, test connectivity to ensure everything works. This order ensures dependencies are met and avoids misconfiguration.'
+15 more Cryptography and Malware Analysis questions available
Practice all Cryptography and Malware Analysis questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Cryptography and Malware Analysis. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Cryptography and Malware Analysis questions on the CEH frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Cryptography and Malware Analysis is tested as part of the Certified Ethical Hacker CEH blueprint. Practicing with targeted Cryptography and Malware Analysis questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CEH practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Cryptography and Malware Analysis is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Cryptography and Malware Analysis practice session with instant scoring and detailed explanations.
Start Cryptography and Malware Analysis Practice →