How many Malware Forensics practice questions does Courseiva have?

Courseiva has 5 Malware Forensics practice questions for the CHFI exam.

What is the best way to practise Malware Forensics questions?

Start with a short focused session to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.

Can I practise only Malware Forensics questions?

Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.

CHFI · domain

Malware Forensics

Practise Computer Hacking Forensic Investigator CHFI Malware Forensics practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

5 questions3 medium2 hard

Start practice test All Computer Hacking Forensic Investigator CHFI questions →

Focused practice

Practice Malware Forensics questions

Scored sessions drawing only from this domain — pick a length below.

What this domain covers

What to know about Malware Forensics

Malware Forensics questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Malware Forensics exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Question index

All Malware Forensics questions (5)

Click any question to see the full explanation, or start a practice session above.

You are investigating a Windows 10 workstation that exhibits slow performance and frequent pop-ups. The user reports that the system started acting strangely after installing a 'PDF Converter' from an email attachment. You suspect malware. You have captured a memory dump using FTK Imager and a network capture during the infection. In the memory dump, you find a suspicious process 'conhost.exe' running from a non-standard location (C:\Users\Public\Temp). The process has an open handle to a file named 'config.ini' in the same directory. The network capture shows periodic HTTPS connections to 'malicious.com' on port 443 from the workstation's IP. Using Volatility, you extract the process's command line: 'conhost.exe -hidden -log C:\Users\Public\Temp\output.log'. Which of the following is the BEST immediate course of action to contain the threat and preserve evidence?

Hard 2

During malware analysis, an investigator finds that a suspicious process is injecting code into a legitimate system process (e.g., explorer.exe). Which technique is being used?

Medium 3

You are a forensic analyst investigating a suspected malware infection on a Windows 10 workstation. The user reports that the system has been slow and that unexpected pop-ups appear. You have acquired a memory dump and a disk image. During analysis, you find a suspicious process named 'svch0st.exe' running with PID 4567. The process has loaded several DLLs, including 'wininet.dll' and 'ws2_32.dll'. You also find that the process has an active TCP connection to an external IP address 203.0.113.5 on port 4444. In the disk image, you find an executable file at C:\Users\Public\svch0st.exe with a creation date that matches the start of symptoms. The file's hash is not in any known malware database. You decide to perform dynamic analysis by running the file in a sandbox. However, the sandbox environment has no network connectivity. The executable runs but does not exhibit any malicious behavior. What should you do next to determine if the file is malicious?

Medium 4

Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?

Hard 5

Based on the exhibit, what is the most likely indication of malware persistence?

Medium

Frequently asked questions

What does the Malware Forensics domain cover on the CHFI exam?: Malware Forensics questions test whether you can apply the concept in context, not just recognise a definition.
How many questions are in this domain?: This page lists all 5 Malware Forensics questions in the CHFI question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
What is the best way to practise this domain?: Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
Can I practise only Malware Forensics questions?: Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.

Practice 25 questions