A company wants to implement application whitelisting on its user workstations. The workstations run a wide variety of applications, and users frequently install new software. The security team is concerned about administrative overhead and user productivity. Which approach balances security and usability?

Allowlist all executables in the default user profile.

Use a default-deny policy with a self-service approval workflow for new applications.

Use a blacklist of known malicious executables.

Disable application whitelisting for standard users.

A security team receives a suspicious file from a user. They want to analyze its behavior without risking the production network. They decide to run it in a sandbox. Which additional step would improve the analysis?

Compare the file's hash against known malware databases.

Monitor the sandbox's network traffic and system calls.

Disable all security controls in the sandbox.

Run the file on a virtual machine with internet access.

A user receives an email with an attachment that, when opened, installs a backdoor and connects to a remote command-and-control server. Which malware category and infection vector does this describe?

Ransomware delivered via malicious website

Worm spreading through network shares

Trojan delivered via email attachment

What is the primary goal of vulnerability management in the context of malware defense?

To identify and remediate weaknesses before they are exploited by malware

To educate users about phishing

To monitor network traffic for malware

GIAC Critical Controls Certification

Domain 5Objective 4

Malware Defenses GCCC Practice Questions (Page 3)

Part of the Security Operations and Monitoring domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 11–15

11foundation · easy
Which type of analysis involves executing malware to observe its runtime behavior?
Select an answer first
12expert · hard
A company wants to implement application whitelisting on its user workstations. The workstations run a wide variety of applications, and users frequently install new software. The security team is concerned about administrative overhead and user productivity. Which approach balances security and usability?
Select an answer first
13application · medium
A security team receives a suspicious file from a user. They want to analyze its behavior without risking the production network. They decide to run it in a sandbox. Which additional step would improve the analysis?
Select an answer first
14application · medium
A user receives an email with an attachment that, when opened, installs a backdoor and connects to a remote command-and-control server. Which malware category and infection vector does this describe?
Select an answer first
15foundation · easy
What is the primary goal of vulnerability management in the context of malware defense?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Malware Defenses GCCC Practice Questions (Page 3)

Questions 11–15

Which type of analysis involves executing malware to observe its runtime behavior?

A security team receives a suspicious file from a user. They want to analyze its behavior without risking the production network. They decide to run it in a sandbox. Which additional step would improve the analysis?

A user receives an email with an attachment that, when opened, installs a backdoor and connects to a remote command-and-control server. Which malware category and infection vector does this describe?

What is the primary goal of vulnerability management in the context of malware defense?

Keep studying — Security Operations and Monitoring