Advanced Exploitation and Malware Analysis

1. What is "dynamic analysis" of malware?

• A. Analyzing source code statically
• B. Executing malware in a controlled environment and observing its runtime behavior ✓
• C. Reading malware documentation
• D. Analyzing malware signatures only

💡 Dynamic analysis runs malware in a controlled sandbox to observe real-time behavior — network connections, file operations, registry changes.

2. What is "hooking" in malware?

• A. Attaching a physical device
• B. Intercepting function calls or system APIs to monitor, modify, or redirect program execution ✓
• C. A type of injection
• D. A debugging technique

💡 Hooking intercepts calls to OS APIs or functions, allowing malware to monitor activity, hide itself, or modify behavior of legitimate processes.

3. What is "process hollowing"?

• A. Emptying CPU processes
• B. Creating a legitimate process in a suspended state, replacing its memory with malicious code, then resuming it ✓
• C. A type of DLL injection
• D. A memory allocation technique

💡 Process hollowing spawns a legitimate process, unmaps its code, injects malware code, then resumes execution — the malware runs under a trusted process name.

4. What is "ASLR" and what does it protect against?

• A. Advanced Security Layer Restriction
• B. Address Space Layout Randomization — randomizing memory addresses to make exploitation harder ✓
• C. A type of firewall
• D. Application Security Layer Rules

💡 ASLR randomizes the base addresses of executables, stack, heap, and libraries, making it difficult for attackers to predict where payloads will land.

5. What is a "NOP sled" in exploitation?

• A. A skiing metaphor
• B. A sequence of no-operation instructions before shellcode, increasing the chance of successful exploitation ✓
• C. A type of buffer overflow
• D. A memory protection technique

💡 A NOP sled is a sequence of no-op instructions that slides execution into shellcode, compensating for imprecise address guessing in exploits.

6. What is "polymorphic shellcode"?

• A. Shellcode that runs multiple times
• B. Shellcode that encrypts or transforms itself to evade signature-based detection while maintaining functionality ✓
• C. A type of NOP sled
• D. Standard shellcode

💡 Polymorphic shellcode changes its appearance through encryption or transformation each time while preserving its malicious functionality.

7. What is "shellcode"?

• A. Code for shell scripting
• B. Small, self-contained machine code used as the payload in exploits to gain control of a system ✓
• C. A type of script
• D. A shell configuration file

💡 Shellcode is compact machine code injected into vulnerable processes during exploitation, typically spawning a command shell or establishing a backdoor.

8. What is "format string vulnerability"?

• A. A text formatting error
• B. A vulnerability where user-controlled input is passed as a format string, enabling memory reads or writes ✓
• C. A type of SQL injection
• D. A buffer overflow variant

💡 Format string vulnerabilities occur when user input is used as a printf format string, allowing attackers to read or write arbitrary memory.

9. What is "credential dumping"?

• A. Creating new credentials
• B. Extracting authentication credentials (hashes, plain text passwords) from memory or storage on a compromised system ✓
• C. A type of phishing
• D. A brute force attack

💡 Credential dumping extracts hashes or plain-text credentials from LSASS memory, SAM database, or password managers on compromised systems.

10. What is "obfuscation" in malware?

• A. Making malware visible
• B. Deliberately making malicious code difficult to understand or detect through encoding or encryption ✓
• C. A type of compression
• D. A debugging technique

💡 Malware obfuscation disguises code through encoding, encryption, or transformation to evade static analysis and signature-based detection.

11. What is "anti-debugging" in malware?

• A. Debugging antivirus software
• B. Techniques malware uses to detect and evade debuggers used in analysis ✓
• C. A type of code obfuscation
• D. A secure coding practice

💡 Anti-debugging techniques detect analysis environments (IsDebuggerPresent, timing checks) and alter behavior to evade security researchers.

12. What is a "sandbox" in malware analysis?

• A. A children's play area
• B. An isolated virtual environment for safely executing and analyzing suspicious files or code ✓
• C. A type of firewall
• D. A network isolation technique

💡 A sandbox is an isolated, monitored environment where malware can run safely to observe its behaviour without affecting real systems.

13. What is "binary diffing"?

• A. Comparing binary files for size
• B. Comparing two binary versions of software to identify changes, often used to find patched vulnerabilities ✓
• C. A type of fuzzing
• D. A reverse engineering technique

💡 Binary diffing compares different versions of binaries to identify what changed — security researchers use it to find patched vulnerabilities before patch application.

14. What is "DEP/NX" in exploit mitigation?

• A. Data Execution Prevention/No-Execute — marking memory regions as non-executable to prevent shellcode execution ✓
• B. A type of ASLR
• C. A firewall technique
• D. A type of encryption

💡 DEP (Data Execution Prevention) / NX bit marks memory regions like the stack as non-executable, preventing injected shellcode from running.

15. What is "heap spraying"?

• A. Scanning heap memory
• B. Filling heap memory with malicious payload to increase exploitation success probability ✓
• C. A type of buffer overflow
• D. A memory optimization technique

💡 Heap spraying fills large areas of heap memory with shellcode, making it more likely that a control flow hijack lands in malicious code.

16. What is "fuzzing" in security testing?

• A. Making code look confusing
• B. Sending malformed, unexpected, or random inputs to an application to discover vulnerabilities ✓
• C. A type of code review
• D. A network testing technique

💡 Fuzzing automatically generates random or malformed inputs to find crashes, memory corruption, and other vulnerabilities in applications.

17. What is "code signing"?

• A. Writing readable code
• B. Cryptographically signing software to verify its authenticity and integrity ✓
• C. A type of encryption
• D. A code review process

💡 Code signing uses digital signatures to verify that software comes from a known publisher and has not been tampered with since signing.

18. What is "memory forensics"?

• A. Physical memory hardware analysis
• B. Analyzing the contents of RAM to investigate running processes, network connections, and malware artifacts ✓
• C. A type of disk forensics
• D. A network packet analysis

💡 Memory forensics examines RAM dumps to find evidence of malware, running processes, encryption keys, and attacker activity invisible to disk forensics.

19. What is "use-after-free" vulnerability?

• A. Using software after its license expires
• B. Accessing memory after it has been freed, potentially allowing code execution ✓
• C. A type of buffer overflow
• D. A use of deprecated functions

💡 Use-after-free occurs when code accesses freed memory — if an attacker controls reallocated memory, they may gain code execution.

20. What is "supply chain attack"?

• A. Attacking delivery trucks
• B. Compromising software or hardware during development or distribution to reach end users via trusted updates ✓
• C. A type of social engineering
• D. A network attack

💡 Supply chain attacks compromise software/hardware before it reaches users — SolarWinds and XZ Utils are major recent examples.