CEH Practice Question: Malware, Social Engineering and Network Attacks
A security analyst receives an alert indicating that a workstation is sending outbound connections to a known malicious IP address. The analyst suspects a Trojan. Which tool is BEST for performing dynamic analysis of the suspicious binary?
⚠ Common exam trap
EC-Council often tests the distinction between static and dynamic analysis, trapping candidates who confuse tools like VirusTotal or PEiD (static) with sandboxing (dynamic) when the question explicitly requires observing runtime behavior such as outbound connections.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sandbox
Dynamic analysis involves executing the suspicious binary in a controlled environment to observe its runtime behavior, such as outbound connections, registry changes, and file system modifications. A sandbox provides an isolated environment specifically designed for this purpose, allowing the analyst to safely monitor the Trojan's actions without risking the production network. This makes it the best choice for analyzing the workstation's outbound connections to a known malicious IP address.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VirusTotal
Why it's wrong here
VirusTotal aggregates results from numerous antivirus engines and blacklisting services to perform static analysis on files and URLs. While it provides a comprehensive view of known threats and indicators of compromise (IOCs) based on signatures and heuristics, it does not execute the malware to observe its runtime behavior, system calls, or network communications in a live environment. Therefore, it's unsuitable for understanding dynamic actions.
- ✓
Sandbox
Why this is correct
A sandbox provides a secure, isolated environment where suspicious binaries can be executed and observed without risking the host system. It meticulously records all dynamic behaviors, including file system modifications, registry changes, network connections, process injections, and API calls. This controlled execution allows security analysts to understand the malware's true intent and operational capabilities in real-time.
- ✗
String analysis
Why it's wrong here
String analysis involves extracting readable text strings from a binary file without executing it. These strings can reveal potential functionalities, error messages, URLs, API calls, or configuration data embedded within the malware. While useful for initial triage and identifying indicators, it is a purely static method that cannot reveal the actual runtime logic or conditional behaviors of the program.
- ✗
PEiD
Why it's wrong here
PEiD (PE Identifier) is a tool specifically designed for static analysis to identify the packer, compiler, or cryptor used to create a Windows Portable Executable (PE) file. By recognizing these attributes, analysts can anticipate obfuscation techniques and choose appropriate unpacking methods. However, PEiD does not execute the binary or monitor its runtime interactions with the operating system or network.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.