CEH Practice Question: Malware, Social Engineering and Network Attacks
Which TWO of the following are types of malware analysis? (Select 2)
⚠ Common exam trap
The CEH exam often tests the distinction between malware analysis types and other security activities like penetration testing or code review, tricking candidates who confuse 'analyzing malware' with 'testing for vulnerabilities' or 'reviewing source code.'
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Static analysis
Static analysis examines malware without executing it, focusing on file structure, strings, and code signatures to identify malicious indicators. Dynamic analysis runs the malware in a controlled sandbox environment to observe runtime behavior, such as registry changes, network connections, and process injections. Both are fundamental malware analysis methodologies recognized by the CEH exam.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Penetration testing
Why it's wrong here
Penetration testing is a simulated cyberattack against a computer system, network, or web application to check for exploitable vulnerabilities. While it involves security assessment, its primary goal is to identify weaknesses in an organization's defenses, not to dissect and understand the internal workings or behavior of a specific piece of malicious software. Therefore, it is distinct from the methodologies used for malware analysis.
- ✓
Static analysis
Why this is correct
Static analysis involves examining malware without executing it, focusing on its internal structure and potential functionality. This method includes disassembling the executable, analyzing strings, inspecting header information, and reviewing embedded resources to infer the malware's capabilities, target APIs, and potential network indicators. It provides insights into the code logic and design before dynamic execution.
- ✓
Dynamic analysis
Why this is correct
Dynamic analysis involves executing the malware in a controlled, isolated environment, such as a sandbox or virtual machine, to observe its real-time behavior. This approach monitors process creation, file system modifications, registry changes, and network communications initiated by the malware. It provides crucial insights into the malware's runtime actions, command-and-control (C2) infrastructure, and overall operational impact.
- ✗
Network analysis
Why it's wrong here
Network analysis, in the context of malware, specifically focuses on monitoring and dissecting the network traffic generated by malicious software during its execution. While critical for identifying command-and-control servers, data exfiltration, or propagation attempts, it is inherently a component or technique employed within dynamic analysis, which observes the malware's behavior in a live environment. It is not considered a standalone primary category of malware analysis.
- ✗
Code review
Why it's wrong here
Code review, when applied to malware, involves a meticulous examination of the malware's disassembled or decompiled source code to understand its logic, algorithms, and potential vulnerabilities. This process is a fundamental technique within static analysis, where the code is scrutinized without execution to identify functions, data structures, and malicious intent. It is a specific method within static analysis, rather than a distinct primary type of malware analysis itself.
Go deeper
Related to this question
Learn chapter
Vulnerability Analysis
Key term
OSINT Techniques
OSINT techniques are methods used to collect information from publicly available sources for security assessments or investigations.
Key term
Evil Twin Attack
An evil twin attack is a type of wireless hacking where a fake Wi-Fi access point mimics a legitimate one to trick users into connecting, allowing the attacker to intercept traffic and steal data.
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.