What is a primary limitation of signature-based malware detection?

It cannot quarantine infected files

It only works on Windows operating systems

It cannot detect previously unseen or polymorphic malware

It requires too much CPU to run on modern systems

A security analyst receives an alert that an unknown executable is attempting to modify the Windows registry Run key and inject code into a running browser process. The file has no known signature. Which detection technique is most appropriate to identify this as malicious?

Application whitelisting that blocks all unknown executables.

Static analysis of the file's embedded strings.

Behavioral analysis that monitors the executable's actions in real time.

Signature-based scanning of the executable's file hash.

A company wants to implement application whitelisting on its servers. The servers run a known set of applications, but some applications update themselves automatically. Which approach would minimize administrative overhead while maintaining security?

Allowlist only the operating system executables.

Allowlist by file hash and update the list manually after each update.

Allowlist by publisher and version, with a process to update the list after patches.

Disable application whitelisting during update windows.

What is the main advantage of heuristic detection over signature-based detection?

It can identify previously unknown malware based on suspicious characteristics

It is faster than signature scanning

It has a lower false positive rate

GIAC Critical Controls Certification

Domain 5Objective 4

Malware Defenses GCCC Practice Questions (Page 1)

Part of the Security Operations and Monitoring domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 1–5

1foundation · easy
What is a primary limitation of signature-based malware detection?
Select an answer first
2application · medium
A security analyst receives an alert that an unknown executable is attempting to modify the Windows registry Run key and inject code into a running browser process. The file has no known signature. Which detection technique is most appropriate to identify this as malicious?
Select an answer first
3application · medium
A company wants to implement application whitelisting on its servers. The servers run a known set of applications, but some applications update themselves automatically. Which approach would minimize administrative overhead while maintaining security?
Select an answer first
4foundation · easy
A security analyst is reviewing a malware report. The malware self-replicates across the network by exploiting a vulnerability in a network service, without requiring user interaction. Which malware category does this describe?
Select an answer first
5foundation · easy
What is the main advantage of heuristic detection over signature-based detection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.