Reverse engineering is used to determine compromises by:

Question

Options

• AAnalyzing the attacker's social media profiles
• BDisassembling and examining the malware code
• CInterviewing the IT staff
• DReviewing firewall logs

• A
  3% (1)
• B
  88% (28)
• C
  3% (1)
• D
  6% (2)

Explanation

Reverse engineering determines how a compromise occurred by disassembling and examining malware code (B) - analysts decompose the binary into readable instructions to understand its behavior, persistence mechanisms, command-and-control communication, and what data it accessed or exfiltrated. Option A (social media profiling) is an OSINT/attribution technique, not a method for understanding how malware works. Option C (interviewing IT staff) is part of incident response but reveals human actions, not technical malware behavior. Option D (firewall logs) shows network traffic patterns but doesn't expose the internal logic of the malicious code itself.

Memory tip: Think of "reverse engineering" literally - you're working backwards from a compiled binary to reconstruct what the attacker built. That reconstruction process requires disassembly tools (like Ghidra or IDA Pro), making B the only choice that matches the definition.

No community discussion yet for this question.