Which of the following is an anti-analysis technique?

• A. Metadata scrubbing
• B. Encryption
• C. Legacy media
• D. Post incident activity

Answer: (B)

Anti-analysis techniques are ways attackers make it harder for security researchers to understand how a threat works, what it does, or what data it handles. Encryption fits this role strongly because it turns payloads, configuration data, or exfiltrated information into unreadable form without the correct key. When malware encrypts its payload or commands, analysts can’t easily statically inspect what the code will do or what data it will exfiltrate; they must discover the key, observe decrypted in memory, or perform more complex runtime analysis to reveal the hidden content. This directly increases the difficulty and time required for analysis, which is the hallmark of an anti-analysis tactic.

Other options don’t target the analysis process in the same direct way. Metadata scrubbing aims to erase traces that might aid attribution rather than impede understanding of the malware’s behavior, and legacy media or post-incident activity refer to artifacts or defender actions rather than techniques designed to thwart analysis of the threat itself.