CEH Cryptography and Malware Analysis Practice Question
An organization is investigating a potential malware infection. The security analyst observes unusual outbound connections to a known malicious IP address and finds a suspicious process running under a user's session. The analyst decides to perform memory analysis using Volatility. Which TWO commands would be most useful to identify the malicious process and its network connections?
⚠ Common exam trap
Test-takers frequently choose `malfind` (option E) because it sounds malware-specific, but it does not list all processes or network connections, whereas `pslist` and `netscan` directly answer the question of identifying the process and its outbound connections.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
volatility -f memory.dmp netscan
The `netscan` plugin in Volatility scans the memory dump for network connections and sockets, including TCP and UDP endpoints, which directly reveals outbound connections to the malicious IP. The `pslist` plugin lists all running processes by walking the process list in the kernel, allowing the analyst to identify the suspicious process by name or PID. Together, these two commands provide the process identity and its network activity, which is exactly what the scenario requires.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
volatility -f memory.dmp netscan
Why this is correct
The `volatility -f memory.dmp netscan` command is crucial for initial malware investigation because it enumerates all active network connections present in the memory dump. This allows incident responders to quickly identify suspicious outbound connections to unknown or malicious IP addresses, which are strong indicators of command and control (C2) communication, data exfiltration, or botnet activity. Confirming such network activity is a primary step in validating a potential infection.
- ✓
volatility -f memory.dmp pslist
Why this is correct
The `volatility -f memory.dmp pslist` command is fundamental for initial malware detection as it provides a comprehensive list of all running processes within the memory image. By examining process names, PIDs, parent PIDs, and execution times, investigators can identify unusual processes, processes running from non-standard locations, or processes with suspicious parent-child relationships, which are common indicators of malware execution. This broad overview helps pinpoint potential malicious executables requiring further scrutiny.
- ✗
volatility -f memory.dmp procdump
Why it's wrong here
The `volatility -f memory.dmp procdump` command is used to extract the executable image or memory regions of a *specific* process from the dump. While invaluable for subsequent in-depth analysis, such as reverse engineering or string extraction from a known malicious process, it requires the investigator to first identify the suspicious process's PID. Therefore, it is not an initial detection tool for broadly identifying an infection but rather a targeted analysis step performed after initial indicators have been found.
- ✗
volatility -f memory.dmp svcscan
Why it's wrong here
The `volatility -f memory.dmp svcscan` command enumerates all registered Windows services and their current states within the memory dump. While some malware achieves persistence by installing itself as a service, many infections operate as userland processes or inject into existing ones without creating new services. Consequently, `svcscan` is less direct for initial detection of active malware behavior compared to analyzing running processes or network connections, which are more immediate indicators of compromise.
- ✗
volatility -f memory.dmp malfind
Why it's wrong here
The `volatility -f memory.dmp malfind` command is designed to detect hidden or injected code within process memory, often indicative of advanced malware techniques like process injection or rootkit functionality. While extremely powerful for confirming sophisticated infections, it focuses on memory regions rather than providing an initial overview of all running processes or active network connections. It is a more specialized detection mechanism, typically employed after initial indicators suggest a process might be compromised.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.