CEH Practice Question: Malware, Social Engineering and Network Attacks
Which malware analysis approach involves running the suspicious file in a controlled environment to observe its behavior?
⚠ Common exam trap
EC-Council often tests the misconception that static analysis is sufficient for all malware types, but the trap here is that candidates confuse 'static analysis' (which examines code without execution) with 'dynamic analysis' (which requires execution), leading them to pick static analysis when the question explicitly asks for observing behavior in a controlled environment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dynamic analysis
Dynamic analysis is the correct approach because it involves executing the suspicious file in a controlled, isolated environment (such as a sandbox or virtual machine) to monitor its runtime behavior, including file system changes, registry modifications, network connections, and process injections. This allows analysts to observe actual malicious actions without risking the production environment, making it essential for understanding zero-day threats and obfuscated malware that static analysis might miss.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Dynamic analysis
Why this is correct
Dynamic analysis involves executing the suspicious malware sample within a controlled environment, such as a sandbox or virtual machine, to observe its real-time behavior. This approach monitors system calls, network communications, file system modifications, and registry changes as the malware runs, providing critical insights into its operational characteristics and potential impact. By observing execution, analysts can understand how the malware interacts with its environment and what malicious actions it attempts.
- ✗
Code review
Why it's wrong here
Code review is a meticulous, manual examination of a program's source code by human analysts to identify vulnerabilities, logical flaws, or malicious constructs. This method requires access to the original source code and does not involve executing the program, making it unsuitable for analyzing compiled binaries without source. While effective for quality assurance and security audits of proprietary software, it cannot directly observe runtime behavior of an unknown executable.
- ✗
Signature detection
Why it's wrong here
Signature detection relies on comparing characteristics of a suspicious file against a database of known malware signatures, which are unique patterns like hash values, specific byte sequences, or API call sequences. This method is effective for identifying previously cataloged threats quickly but cannot detect new, polymorphic, or zero-day malware that lacks a known signature. It operates statically, without executing the file, focusing solely on pattern matching rather than behavioral observation.
- ✗
Static analysis
Why it's wrong here
Static analysis involves examining a malware sample without executing it, focusing on its inherent properties and structure. This includes disassembling the binary, analyzing strings, inspecting metadata, identifying imported functions, and mapping control flow graphs to infer potential malicious functionality. While it can reveal much about a program's capabilities and structure, it cannot fully uncover runtime-dependent behaviors, obfuscated code, or environmental checks that only manifest during execution.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.