CHFI Mobile and Malware Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Static analysis executes the malware, dynamic does not

  Why it's wrong here

  This statement is the exact opposite of the truth. Static analysis is performed on a non-running sample—typically using a disassembler such as IDA Pro or Ghidra to inspect instructions, strings, and metadata—so the malware never executes. Dynamic analysis, conversely, deliberately runs the sample in a controlled sandbox or virtual machine to observe its runtime behavior, such as registry modifications, file system changes, and network connections.

• ✗

  Static analysis requires an internet connection, dynamic does not

  Why it's wrong here

  Neither static nor dynamic analysis inherently requires an internet connection. Static analysis only reads file bytes, so it is inherently offline. Dynamic analysis often runs in an isolated sandbox that may simulate network services (e.g., INetSim or fake DNS) to trick the malware, but the analysis host itself can be completely disconnected from the internet. Requiring internet would actually be a risk because real malware can exfiltrate data or download additional payloads, so analysts intentionally avoid a live internet link.

• ✓

  Static analysis examines code without execution, dynamic analysis executes the sample

  Why this is correct

  This is the fundamental distinction between the two analysis categories. Static analysis inspects the binary's code and structure without ever executing it, using techniques like disassembly, decompilation, and string extraction to infer behavior. Dynamic analysis executes the sample in a monitored environment, capturing its actual runtime actions such as API calls, process injection, and file operations, which often reveals behaviors that static analysis alone cannot see.

• ✗

  Static analysis is always automated, dynamic is manual

  Why it's wrong here

  Automation level is not the defining difference. Static analysis can be highly automated—for example, antivirus engines, YARA rules, or scripts that scan for known signatures—and it can also be a slow, manual reverse-engineering process. Dynamic analysis likewise ranges from fully automated sandboxes like Cuckoo or CAPE, which run samples without human interaction, to manual debugging in x64dbg or WinDbg. Both approaches can be adapted to either manual or automated workflows.

Go deeper

Related to this question