Which of the following setups should a tester choose to analyze malware behavior?

The correct answer is D. A virtual system with network simulation for internet connection. A virtual machine with simulated network access is the gold standard for malware behavioral analysis. The VM provides isolation so malware cannot directly damage the host or escape to real infrastructure. Network simulation tools (e.g., INetSim, FakeNet-NG) mimic internet…

Submitted by sofia.br· Apr 18, 2026Malware Forensics

Question

Options

AA virtual system with internet connection
BA normal system without internet connect
CA normal system with internet connection
DA virtual system with network simulation for internet connection

How the community answered

(34 responses)

A
3% (1)
B
12% (4)
C
3% (1)
D
82% (28)

Explanation

A virtual machine with simulated network access is the gold standard for malware behavioral analysis. The VM provides isolation so malware cannot directly damage the host or escape to real infrastructure. Network simulation tools (e.g., INetSim, FakeNet-NG) mimic internet services - DNS, HTTP, SMTP - allowing analysts to observe all malware network behavior safely without connecting to live internet resources. A VM with a real internet connection is risky as malware can phone home, receive commands, or spread. Using a physical (normal) machine risks permanent system compromise.

Topics

#Malware Analysis Environment#Virtualization#Network Simulation#Sandboxing

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice