Reverse Engineering Quiz

Q1. `ltrace` reveals a program's:

Network packets System calls Registry keys Library (e.g. libc) calls at runtime

Q2. Ghidra and IDA are principally used to:

Disassemble and decompile compiled code Scan networks Capture packets Crack hashes

Q3. Malware that checks CPU count, uptime and MAC prefixes is performing:

Persistence Sandbox and virtual-machine evasion Privilege escalation Lateral movement

Q4. A very high entropy section in a PE file usually suggests:

An icon resource Packed or encrypted content Plain ASCII text Debug symbols

Q5. The file command identifies a binary primarily by:

Magic bytes at the start of the file Its size Its extension Its timestamp

Q6. Fileless malware is so named because it primarily:

Has no code Uses no network Runs from memory and living-off-the-land tools rather than a dropped executable Only infects documents

Q7. A key safety measure for dynamic malware analysis is:

Using an isolated sandbox/VM Running it as root Disabling antivirus Running it on your host

Q8. ltrace differs from strace in that ltrace traces:

Network packets Library function calls rather than system calls Kernel scheduling Disk blocks

Q9. The NX / DEP protection prevents:

Reading kernel memory Format-string bugs Buffer overflows entirely Execution of code from pages marked as data, such as the stack

Q10. The strings utility is useful early because it can reveal:

The compiler's optimisation level The author's name always URLs, registry keys, file paths and error messages left in the binary The exact CPU instruction count

Q11. Static analysis means examining malware:

While it executes Without executing it Only in production Only over the network

Q12. A rootkit is characterised by its goal of:

Encrypting the disk Hiding its presence from the operating system and tools Displaying adverts Spreading over the network fastest

Q13. A worm differs from a virus because a worm:

Only affects Linux Spreads without needing a host file or user action Needs a boot sector Cannot delete data

Q14. A YARA rule is used to:

Disassemble ARM code Encrypt samples Match samples against patterns of strings and byte sequences Emulate a CPU

Q15. Setting a breakpoint in a debugger lets an analyst:

Delete the malware Recompile the binary Sign the binary Pause execution at a chosen instruction and inspect state