A housing-authority reverse engineer observes a lab sample that detects a debugger and immediately exits before revealing useful strings. Which category best fits that behavior?

Anti-analysis techniques detect debuggers, sandboxes, VMs, or instrumentation and then alter or abort execution so reverse engineers see little useful behavior or few clear strings. When a housing-authority reverse engineer observes a lab sample that detects a debugger and immediately exits before revealing useful strings, that behavior fits anti-analysis: the sample’s goal is to frustrate examination, not to enumerate networks or persuade residents. Civic malware labs must classify this correctly so analysts adjust dynamic-analysis plans—different tools, timing, environment spoofing awareness, or complementary static approaches—rather than concluding the sample is benign because it ‘does nothing’ under a debugger.

Authorized network enumeration of housing VLAN gateways fails because enumeration is mapping hosts/services under ROE, not debugger-triggered early exit. Social-engineering psychology applied to residents fails because that concerns human influence, not binary anti-RE behavior in a lab. RAG retrieval over housing policy PDFs fails as a category; retrieval-augmented generation is an AI knowledge pattern, unrelated to debugger detection and abort.

Exam caveat: anti-analysis (frustrate labs/RE) is related to but distinct from anti-detection (evade AV/EDR/signatures). Debugger checks that exit early are the former. Do not invent exploit steps the question does not ask for.

Operational check for a housing malware lab: record the debugger/environment check as an anti-analysis finding, try controlled alternate analysis paths consistent with lab policy, extract indicators from any brief execution windows or packed layers carefully, and brief SOC hunters that production hosts may still run the sample even when the debugger build exits—absence of lab strings is not proof of safety on resident-services PCs.