A company has a critical legacy application that cannot be patched because the vendor no longer provides updates. The application is exposed to the internet and is a known target for malware. Which combination of compensating controls would most effectively reduce the risk of exploitation?

User education and strong password policies

Disabling the application during non-business hours

Increasing antivirus signature update frequency

Network segmentation, application whitelisting, and host-based intrusion detection

A company experienced a malware outbreak that exploited a known vulnerability in a third-party application. The vulnerability had a patch available for two months, but it was not applied. Which control would have most likely prevented this infection?

Timely patch management for the application.

Stronger endpoint antivirus signatures.

Network segmentation to isolate the application.

User education on phishing emails.

A company is experiencing a malware outbreak. The malware is spreading through email attachments and also exploits a known vulnerability in a web browser. The security team is implementing a layered defense. Which of the following controls would be effective in preventing or mitigating this outbreak? Select all that apply.

Conduct user awareness training on phishing emails.

Patch the web browser to the latest version.

Deploy email filtering to block malicious attachments.

Disable the web browser's JavaScript.

Use application whitelisting to block unauthorized executables.

A malware analyst is examining a suspicious file in a sandbox. The file appears to detect that it is running in a virtual environment and delays its malicious behavior. Which technique would help the analyst obtain useful behavioral data?

Use a bare-metal sandbox or a sandbox with anti-evasion techniques.

Analyze the file statically instead of dynamically.

Run the file on a production system to observe real behavior.

Run the file with a longer timeout to wait for the delayed behavior.

GIAC Critical Controls Certification

Domain 5Objective 4

Malware Defenses GCCC Practice Questions (Page 4)

Part of the Security Operations and Monitoring domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 16–20

16expert · hard
A company has a critical legacy application that cannot be patched because the vendor no longer provides updates. The application is exposed to the internet and is a known target for malware. Which combination of compensating controls would most effectively reduce the risk of exploitation?
Select an answer first
17application · medium
A company experienced a malware outbreak that exploited a known vulnerability in a third-party application. The vulnerability had a patch available for two months, but it was not applied. Which control would have most likely prevented this infection?
Select an answer first
18foundation · easy
Which detection technique identifies malware by analyzing the actions a program takes, such as modifying registry keys or encrypting files?
Select an answer first
19expert · hard · select all that apply
A company is experiencing a malware outbreak. The malware is spreading through email attachments and also exploits a known vulnerability in a web browser. The security team is implementing a layered defense. Which of the following controls would be effective in preventing or mitigating this outbreak? Select all that apply.
Select an answer first
20expert · hard
A malware analyst is examining a suspicious file in a sandbox. The file appears to detect that it is running in a virtual environment and delays its malicious behavior. Which technique would help the analyst obtain useful behavioral data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Malware Defenses GCCC Practice Questions (Page 4)

Questions 16–20

A company has a critical legacy application that cannot be patched because the vendor no longer provides updates. The application is exposed to the internet and is a known target for malware. Which combination of compensating controls would most effectively reduce the risk of exploitation?

A company experienced a malware outbreak that exploited a known vulnerability in a third-party application. The vulnerability had a patch available for two months, but it was not applied. Which control would have most likely prevented this infection?

Which detection technique identifies malware by analyzing the actions a program takes, such as modifying registry keys or encrypting files?

A malware analyst is examining a suspicious file in a sandbox. The file appears to detect that it is running in a virtual environment and delays its malicious behavior. Which technique would help the analyst obtain useful behavioral data?

Keep studying — Security Operations and Monitoring