CEH Practice Question: Malware, Social Engineering and Network Attacks
Which TWO of the following are types of malware analysis? (Select two.)
⚠ Common exam trap
CEH often tests the distinction between analysis types (static/dynamic) and detection methods (signature/heuristic), causing candidates to confuse detection techniques with analysis methodologies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Static analysis
Static analysis involves examining malware without executing it, such as inspecting file headers, strings, and disassembled code. Dynamic analysis executes the malware in a controlled sandbox to observe its runtime behavior, including network traffic, registry changes, and process creation. Both are fundamental malware analysis methodologies recognized in CEH.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Static analysis
Why this is correct
Static analysis involves dissecting malware binaries without executing them, examining the code, structure, and embedded resources. This process often includes disassembling or decompiling the executable, extracting strings, analyzing PE headers, and identifying imported/exported functions to infer potential malicious capabilities. Its primary goal is to understand the malware's design, identify obfuscation techniques, and predict its behavior before it ever runs, providing crucial initial insights into its functionality.
- ✗
Memory analysis
Why it's wrong here
Memory analysis is a specialized forensic technique that involves examining the contents of a computer's volatile memory (RAM) at a specific point in time. While incredibly valuable for uncovering hidden processes, injected code, rootkits, or data exfiltration attempts, it is typically performed after an incident or during dynamic analysis to capture runtime artifacts. It serves as a powerful tool within incident response and advanced analysis, rather than a primary, overarching category of malware analysis methodology itself, which are broadly defined as static or dynamic.
- ✗
Signature analysis
Why it's wrong here
Signature analysis is a detection method where known patterns, hashes, or unique byte sequences of previously identified malware are matched against suspicious files. This technique is highly effective for detecting known threats quickly and is a core component of many antivirus solutions, often employed during static scanning. However, it is a specific detection mechanism rather than a comprehensive analysis methodology used to deeply understand novel malware's full functionality and intent, which requires more in-depth static or dynamic approaches.
- ✓
Dynamic analysis
Why this is correct
Dynamic analysis involves executing malware within a controlled, isolated environment, such as a sandbox or virtual machine, to observe its real-time behavior. Analysts monitor various aspects, including file system modifications, registry changes, network communications, process injections, and API calls, to understand the malware's operational flow and impact. This method is crucial for revealing the full extent of a threat's capabilities, its command-and-control infrastructure, and its payload delivery mechanisms, providing actionable intelligence on its runtime characteristics.
- ✗
Heuristic analysis
Why it's wrong here
Heuristic analysis is a proactive detection technique that identifies potential malware by recognizing suspicious characteristics or behaviors, even if a specific signature is unknown. This method relies on rules, algorithms, or machine learning models to evaluate attributes like unusual file permissions, suspicious API call sequences, or abnormal process activity. While effective for detecting zero-day threats and polymorphic malware, it is fundamentally a detection strategy employed by security products, not a primary methodology for comprehensive, in-depth malware reverse engineering or behavioral understanding.
Go deeper
Related to this question
Learn chapter
Vulnerability Analysis
Key term
Nmap Scanning
Nmap scanning is a method used to discover devices running on a network and find open ports, services, and security weaknesses.
Key term
Covering Tracks
Covering tracks is the process attackers use to hide their activity and remove evidence of a security breach after gaining unauthorized access to a system.
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.