312-39 Forensic Investigation And Malware Analysis Practice Question
When analyzing network traffic associated with a malware C2 channel, you observe encrypted traffic. Which approach allows you to inspect the content of this traffic without the malware's private key?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an SSL/TLS intercepting proxy
Using a transparent SSL/TLS proxy (like an intercepting proxy) allows the analyst to decrypt traffic if the certificate is trusted by the client.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use an SSL/TLS intercepting proxy
Why this is correct
Interception proxies act as a man-in-the-middle to decrypt traffic.
- ✗
Use Nmap to scan for open ports
Why it's wrong here
Nmap does not decrypt traffic.
- ✗
Use Wireshark to brute force the key
Why it's wrong here
Brute forcing is computationally infeasible for modern TLS.
- ✗
Analyze the payload in a debugger
Why it's wrong here
Debuggers analyze the binary, they do not automatically decrypt network traffic.
About these practice questions
Courseiva writes every 312-39 question from scratch — 201 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This 312-39 practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 312-39 exam.