CEH Practice Question: Malware, Social Engineering and Network Attacks
Which of the following tools is commonly used for dynamic malware analysis by executing the malware in an isolated environment and monitoring system changes?
⚠ Common exam trap
EC-CEH often tests the distinction between static and dynamic analysis tools, and the trap here is that candidates may confuse VirusTotal's file scanning (which is static and signature-based) with true dynamic sandbox execution, or assume that Strings or PEiD can perform runtime monitoring when they are purely static analysis utilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cuckoo Sandbox
Cuckoo Sandbox is the correct answer because it is an open-source automated malware analysis system specifically designed for dynamic analysis. It executes suspicious files in an isolated, virtualized environment (e.g., VirtualBox, KVM) and monitors system changes such as file system modifications, registry changes, network connections, and process behavior in real time, providing a detailed report of the malware's runtime activities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Strings
Why it's wrong here
Strings is a command-line utility designed to extract printable character sequences from binary files. This process involves examining the file's raw data without executing it, making it a form of static analysis. While useful for identifying potential indicators like file paths, URLs, or API calls embedded within malware, it does not observe the malware's behavior during execution, which is the hallmark of dynamic analysis.
- ✗
PEiD
Why it's wrong here
PEiD (PE Identifier) is a specialized tool primarily used for static analysis to identify the packer, compiler, or cryptor used to create a Portable Executable (PE) file. It achieves this by scanning the file for signatures and specific characteristics within its header and sections, all without executing the binary. This identification helps analysts understand potential obfuscation techniques but does not involve monitoring runtime behavior, thus disqualifying it as a dynamic analysis tool.
- ✗
VirusTotal
Why it's wrong here
VirusTotal is an online platform that aggregates results from numerous antivirus engines and various analysis tools to scan submitted files and URLs for malicious content. While it provides a broad security assessment and some behavioral reports via integrated sandbox services, its primary function is signature-based detection and reputation checking across a multitude of vendors, not providing a dedicated, interactive dynamic analysis environment for an analyst to observe execution in real-time. It acts as a scanner, not a sandbox.
- ✓
Cuckoo Sandbox
Why this is correct
Cuckoo Sandbox is an open-source automated malware analysis system specifically designed for dynamic analysis. It executes suspicious files within an isolated virtual environment, commonly referred to as a sandbox, and meticulously monitors their runtime behavior. This includes observing API calls, network traffic, file system changes, and process interactions, providing a comprehensive report on the malware's actions and intent, which is the core objective of dynamic analysis.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.