- A
Conduct a thorough static analysis using a disassembler and debugger to understand the code
Why wrong: Static analysis is useful but may not reveal behavior that only triggers under specific conditions, such as network activity.
- B
Delete the suspicious file and run a full antivirus scan on the system
Why wrong: Deleting evidence and relying solely on antivirus may miss advanced malware.
- C
Re-run the sample in a sandbox with simulated network connectivity or a controlled network to observe C2 communication
Network connectivity may be required for the malware to activate its malicious payload.
- D
Perform a forensic imaging of the system again and compare with the original image
Why wrong: Re-imaging does not help determine the file's behavior; dynamic analysis with network is needed.
Quick Answer
The answer is to re-run the sample in a sandbox with simulated network connectivity or a controlled network to observe C2 communication. This is correct because many malware strains, particularly those designed for command-and-control (C2) operations, use a trigger mechanism that requires a successful network handshake before deploying their malicious payload. Without network connectivity, the malware remains dormant, as seen with the 'svch0st.exe' process that loaded networking DLLs like wininet.dll and ws2_32.dll but failed to exhibit behavior when isolated. On the CHFI exam, this scenario tests your understanding of dynamic analysis limitations and the importance of network simulation in forensic sandboxing—a common trap is assuming a file is benign simply because it doesn't activate in a disconnected environment. Remember the key insight: if you want to trigger malware C2 with network connectivity sandbox, you must provide a route for the beacon to call home. Memory tip: "No net, no threat—connect to detect."
CHFI Malware Forensics Practice Question
This CHFI practice question tests your understanding of malware forensics. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You are a forensic analyst investigating a suspected malware infection on a Windows 10 workstation. The user reports that the system has been slow and that unexpected pop-ups appear. You have acquired a memory dump and a disk image. During analysis, you find a suspicious process named 'svch0st.exe' running with PID 4567. The process has loaded several DLLs, including 'wininet.dll' and 'ws2_32.dll'. You also find that the process has an active TCP connection to an external IP address 203.0.113.5 on port 4444. In the disk image, you find an executable file at C:\Users\Public\svch0st.exe with a creation date that matches the start of symptoms. The file's hash is not in any known malware database. You decide to perform dynamic analysis by running the file in a sandbox. However, the sandbox environment has no network connectivity. The executable runs but does not exhibit any malicious behavior. What should you do next to determine if the file is malicious?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Re-run the sample in a sandbox with simulated network connectivity or a controlled network to observe C2 communication
Option C is correct because the sandbox lacked network connectivity, which prevented the malware from reaching its command-and-control (C2) server. Many malware samples, especially those using HTTP or raw TCP for C2, will remain dormant or exhibit no malicious behavior when they cannot connect to the external IP. By providing simulated or controlled network connectivity, you can trigger the malicious payload and observe the actual C2 communication, confirming the file's intent.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conduct a thorough static analysis using a disassembler and debugger to understand the code
Why it's wrong here
Static analysis is useful but may not reveal behavior that only triggers under specific conditions, such as network activity.
- ✗
Delete the suspicious file and run a full antivirus scan on the system
Why it's wrong here
Deleting evidence and relying solely on antivirus may miss advanced malware.
- ✓
Re-run the sample in a sandbox with simulated network connectivity or a controlled network to observe C2 communication
Why this is correct
Network connectivity may be required for the malware to activate its malicious payload.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Perform a forensic imaging of the system again and compare with the original image
Why it's wrong here
Re-imaging does not help determine the file's behavior; dynamic analysis with network is needed.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the misconception that static analysis is always sufficient to determine maliciousness, but the trap here is that malware can be conditionally dormant and only activate when network connectivity is present, making dynamic analysis with network simulation essential.
Detailed technical explanation
How to think about this question
Under the hood, many malware families use a 'sleep-and-retry' or 'network-check' routine before executing malicious code; they call WinAPI functions like `InternetOpen` or `WSAStartup` to establish a socket, and if the connection fails, they exit cleanly. In a real-world scenario, a forensic analyst might use a tool like INetSim or a custom Python script to simulate DNS and HTTP responses, tricking the malware into thinking it has reached the C2 server. This technique is critical for analyzing malware that uses domain generation algorithms (DGAs) or hardcoded IPs, as it allows the analyst to capture the full attack chain without exposing the real network.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the CHFI exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Malware Forensics — study guide chapter
Learn the concepts, then practise the questions
- →
Malware Forensics practice questions
Targeted practice on this topic area only
- →
All CHFI questions
1,000 questions across all exam domains
- →
Computer Hacking Forensic Investigator CHFI study guide
Full concept coverage aligned to exam objectives
- →
CHFI practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related CHFI practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Computer Forensics Investigation Process practice questions
Practise CHFI questions linked to Computer Forensics Investigation Process.
Computer Forensics Fundamentals and Process practice questions
Practise CHFI questions linked to Computer Forensics Fundamentals and Process.
Storage Forensics and File System Analysis practice questions
Practise CHFI questions linked to Storage Forensics and File System Analysis.
Incident Response and First Responder Skills practice questions
Practise CHFI questions linked to Incident Response and First Responder Skills.
Computer Forensics Lab practice questions
Practise CHFI questions linked to Computer Forensics Lab.
Evidence Acquisition and Duplication practice questions
Practise CHFI questions linked to Evidence Acquisition and Duplication.
OS and Network Forensics practice questions
Practise CHFI questions linked to OS and Network Forensics.
OS and File System Forensics practice questions
Practise CHFI questions linked to OS and File System Forensics.
Application, Email and Cloud Forensics practice questions
Practise CHFI questions linked to Application, Email and Cloud Forensics.
Mobile and Malware Forensics practice questions
Practise CHFI questions linked to Mobile and Malware Forensics.
Network and Cloud Forensics practice questions
Practise CHFI questions linked to Network and Cloud Forensics.
Database and Application Forensics practice questions
Practise CHFI questions linked to Database and Application Forensics.
Practice this exam
Start a free CHFI practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this CHFI question test?
Malware Forensics — This question tests Malware Forensics — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Re-run the sample in a sandbox with simulated network connectivity or a controlled network to observe C2 communication — Option C is correct because the sandbox lacked network connectivity, which prevented the malware from reaching its command-and-control (C2) server. Many malware samples, especially those using HTTP or raw TCP for C2, will remain dormant or exhibit no malicious behavior when they cannot connect to the external IP. By providing simulated or controlled network connectivity, you can trigger the malicious payload and observe the actual C2 communication, confirming the file's intent.
What should I do if I get this CHFI question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More CHFI practice questions
- Which TWO of the following are valid reasons for using a hardware write blocker during disk acquisition? (Choose two.)
- During a forensic investigation, an analyst needs to acquire the contents of a live server's RAM without altering the ev…
- You are a forensic investigator responding to a data breach at a mid-sized company. The company uses a hybrid cloud envi…
- Which TWO of the following are valid techniques for collecting volatile network evidence from a live system during incid…
- A first responder is responding to a ransomware incident on a Windows server. Which TWO actions should be performed to p…
- Refer to the exhibit. A first responder runs the netstat command on a compromised Windows workstation. Which of the foll…
Last reviewed: Jun 11, 2026
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.