Chapter 7 of 8 · EC-Council 312-39
Forensics Investigation and Malware Analysis
Evidence handling, network, application, email and insider investigations, and malware analysis (5%).
- 3topics
- 15 minfast track
- 5%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Forensic Investigation and Investigating Network IncidentsLearn the forensic investigation process, evidence handling, chain of custody and how to investigate network security incidents…5 min
- 2Investigating Application, Email and Insider IncidentsLearn how to investigate web application attacks, email headers and phishing, and insider incidents with logs and endpoint data…5 min
- 3Malware Analysis, Static and DynamicLearn why SOCs analyze malware, how static analysis reads a file without running it and how dynamic analysis watches it run in a…5 min
About this chapter
What this chapter covers
Forensics Investigation and Malware Analysis is 5% of the EC-Council CSA 312-39 exam. It covers the forensic investigation process and evidence handling, how to investigate network, application, email and insider incidents, and static and dynamic malware analysis.
Questions are single-answer multiple choice, often "Which of the following" and short named scenarios. You are asked what an alert, log entry or IoC means and what the next triage or response step should be, here with a focus on evidence and analysis.
It has 8 outline topics, and three pages cover them.
How the topics fit together
Investigation starts with sound evidence handling, applies it to each incident type, and ends with analysis of any malware found.
- The first page sets the evidence rules and covers network investigation.
- The second page covers the evidence for application, email and insider cases.
- The third page turns a malware sample into indicators the SOC can use.
When an answer choice changes the original evidence, such as running tools on the suspect system or rebooting it, it is almost always wrong. Preserve, copy, hash, then analyze.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Try to name the next step for each short scenario before reading the answer. The exam often asks what to do first, or which tool fits.
Ready for more practice?
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.