How many Malware Forensics questions are on the CHFI exam?

The Malware Forensics domain represents approximately 7% of the CHFI exam. In a typical CHFI exam of around 205 questions, that is roughly 14 questions from this domain.

How can I practice Malware Forensics questions for CHFI?

Click any of the 5 questions listed on this page to see the full question and explanation, or use the session launcher to start a focused practice session of 10, 20, 30 or 50 questions drawn only from the Malware Forensics domain.

Free CHFI Malware Forensics Practice Questions (2026)

Q: What does the Malware Forensics domain cover on the CHFI exam?

The Malware Forensics domain covers the key concepts and skills tested in this area of the CHFI exam blueprint published by EC-Council.

Practice Malware Forensics questions

10Q 20Q 30Q 50Q

All CHFI Malware Forensics questions (5)

Start session

Click any question to see the full explanation and answer options, or start a focused practice session above.

During malware analysis, an investigator finds that a suspicious process is injecting code into a legitimate system process (e.g., explorer.exe). Which technique is being used?

Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?

You are a forensic analyst investigating a suspected malware infection on a Windows 10 workstation. The user reports that the system has been slow and that unexpected pop-ups appear. You have acquired a memory dump and a disk image. During analysis, you find a suspicious process named 'svch0st.exe' running with PID 4567. The process has loaded several DLLs, including 'wininet.dll' and 'ws2_32.dll'. You also find that the process has an active TCP connection to an external IP address 203.0.113.5 on port 4444. In the disk image, you find an executable file at C:\Users\Public\svch0st.exe with a creation date that matches the start of symptoms. The file's hash is not in any known malware database. You decide to perform dynamic analysis by running the file in a sandbox. However, the sandbox environment has no network connectivity. The executable runs but does not exhibit any malicious behavior. What should you do next to determine if the file is malicious?

Based on the exhibit, what is the most likely indication of malware persistence?

You are investigating a Windows 10 workstation that exhibits slow performance and frequent pop-ups. The user reports that the system started acting strangely after installing a 'PDF Converter' from an email attachment. You suspect malware. You have captured a memory dump using FTK Imager and a network capture during the infection. In the memory dump, you find a suspicious process 'conhost.exe' running from a non-standard location (C:\Users\Public\Temp). The process has an open handle to a file named 'config.ini' in the same directory. The network capture shows periodic HTTPS connections to 'malicious.com' on port 443 from the workstation's IP. Using Volatility, you extract the process's command line: 'conhost.exe -hidden -log C:\Users\Public\Temp\output.log'. Which of the following is the BEST immediate course of action to contain the threat and preserve evidence?

Other CHFI exam domains

Computer Forensics Investigation Process Computer Forensics Fundamentals and Process Storage Forensics and File System Analysis Incident Response and First Responder Skills Computer Forensics Lab Evidence Acquisition and Duplication OS and Network Forensics OS and File System Forensics Application, Email and Cloud Forensics Mobile and Malware Forensics Network and Cloud Forensics Database and Application Forensics

Frequently asked questions

What does the Malware Forensics domain cover on the CHFI exam?

The Malware Forensics domain covers the key concepts tested in this area of the CHFI exam blueprint published by EC-Council. Courseiva provides free domain-focused practice, mock exams, missed-question review, and readiness tracking across all CHFI domains — no account required.

How many Malware Forensics questions are in the CHFI question bank?

The Courseiva CHFI question bank contains 5 questions in the Malware Forensics domain, covering the 7% of the exam attributed to this domain in the official EC-Council blueprint. Click any question to see the full explanation and answer breakdown.

What is the best way to practice Malware Forensics for CHFI?

Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.

Can I practice only Malware Forensics questions for CHFI?

Yes — the session launcher on this page draws questions exclusively from the Malware Forensics domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.

Free forever · No credit card required

Track your CHFI domain progress

Save your results, see per-domain analytics, and get readiness scores — free, for every certification.

Free forever · Every certification included