Which of the following is an anti-analysis technique?

• A. Metadata scrubbing
• B. Fake OS or hidden ephemeral computing
• C. Encryption
• D. Authentication tokens

Answer: (B)

Anti-analysis techniques are methods that hinder or mislead investigators watching how a program behaves, so the true actions aren’t observed reliably. Presenting a fake OS or a hidden ephemeral computing environment does exactly that: the software detects that it’s in an analysis setup (like a sandbox or short‑lived VM) and can alter its behavior or stay dormant, making it difficult for researchers to see what it would do in a real system. This direct aim of evading observation and delaying or concealing actions makes it a classic anti-analysis tactic.

Metadata scrubbing, while it can complicate forensic efforts by removing traces, isn’t about deceiving the analysis environment itself during dynamic examination. Encryption protects data confidentiality and can hinder data access, but it’s not specifically an anti-analysis method aimed at thwarting the analysis process. Authentication tokens are about access control and don’t relate to evading analysis either.