View all questions & answers for the NSE 5 - FortiSandbox 5.0 Administrator Exam Materials exam

NSE 5 - FortiSandbox 5.0 Administrator Exam Materials - Question #24 Discussion

Comment Image Comment Image Comment Image

How do attackers typically perform anti-virtualization checks during malware execution to evade sandbox detection? (Choose one answer)

  • A. By making outbound C&C connections
  • B. By disabling network access
  • C. By querying for system components
  • D. By making function calls to system DLLs
Correct Answer: C

Brave-Dump Community Votes

Answer: C (1 vote) 100%

Community Explanations & Comments (1)

Max 4 months ago
Selected: C
Anti-virtualization checks are techniques malware uses to detect if it's running inside a virtual machine (VM) or an analysis sandbox. Common methods include:

Calling system DLL functions (such as kernel32.dll, user32.dll, ntdll.dll, etc.).
Querying information about hardware, BIOS, processes, drivers, or virtual devices.
Looking for artifacts characteristic of VMware, VirtualBox, Hyper-V, etc.