CEH Practice Question: Malware, Social Engineering and Network Attacks
A forensic analyst examines a system infected with malware that displays ransomware notes and encrypts files. The analyst uses a sandbox to observe behavior. During analysis, the malware contacts a C2 server and downloads additional payloads. Which type of malware analysis is being performed?
⚠ Common exam trap
EC-CEH often tests the distinction between dynamic and static analysis by describing runtime behavior (like C2 contact) and expecting candidates to recognize that only dynamic analysis involves executing the sample in a sandbox. A common mistake is to select 'network analysis' because the malware contacts a C2 server, but network analysis is a subset of dynamic analysis; the question specifically emphasizes sandbox execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dynamic analysis
Dynamic analysis involves executing the malware in a controlled environment (sandbox) to observe its runtime behavior, such as contacting a C2 server and downloading additional payloads. This contrasts with static analysis, which examines the code without execution. The scenario explicitly describes observing behavior during execution, confirming dynamic analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Dynamic analysis
Why this is correct
Dynamic analysis involves executing the malware within a controlled, isolated environment, such as a sandbox or virtual machine, to observe its real-time behavior. This method allows forensic analysts to meticulously document system changes, process interactions, file modifications, and network communications initiated by the malicious code as it runs. It is crucial for understanding the full operational impact and capabilities of sophisticated threats.
- ✗
Static analysis
Why it's wrong here
Static analysis examines the malware's characteristics without actually executing its code. This process involves disassembling binaries, extracting strings, analyzing file headers, and reviewing embedded resources to infer potential functionality and identify indicators of compromise. While it provides valuable insights into the malware's structure and potential capabilities, it cannot reveal runtime-specific behaviors or evasion techniques that only manifest during execution.
- ✗
Network analysis
Why it's wrong here
Network analysis specifically focuses on monitoring and dissecting the network traffic generated by or directed towards the infected system. While essential for identifying command-and-control communications, data exfiltration attempts, or propagation activities, it primarily observes external network interactions. This method does not directly reveal internal system modifications, process injections, or local file system changes that occur within the host itself.
- ✗
Code analysis
Why it's wrong here
Code analysis is a specialized technique that involves meticulously examining the malware's source code or reverse-engineering its compiled binary to understand its underlying logic and algorithms. This process often includes disassembly, decompilation, and debugging to trace execution paths and identify malicious functions. Although fundamental for understanding *how* the malware operates, it is a component of static analysis and does not involve the live execution necessary to observe dynamic system interactions or runtime effects.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.