In incident response, choose the correct description of malware analysis levels.

• A. Static analysis examines binaries without executing; Dynamic analysis observes behavior in a sandbox; Behavioral/over-time analysis monitors ongoing file, system, and network interactions.
• B. Static and dynamic analysis are identical.
• C. Behavioral analysis is unnecessary.
• D. Dynamic analysis only analyzes network traffic.

Answer: (A)

Understanding how malware analysis is structured in incident response. Static analysis examines the binary without executing it, pulling out strings, imports, and code structure to infer capabilities. Dynamic analysis runs the sample in a controlled sandbox to observe what it does when it executes—file system changes, new processes, registry edits, and network activity. Behavioral or over-time analysis looks at how the malware behaves across multiple runs or over time to reveal persistence mechanisms, beaconing patterns, data access, and resource usage. Taken together, these levels provide a complete view: what the malware could do statically, what it actually does during execution, and how its actions evolve over time.

Static and dynamic analysis are not identical; they provide complementary insights—static reveals potential capabilities from code alone, while dynamic shows real-world behavior during execution. Behavioral analysis is essential for understanding long-term actions and patterns that may not appear in a single run. Dynamic analysis is not limited to network traffic; it also captures how the malware interacts with the system, such as file changes, process creation, and registry modifications.