An analyst is performing dynamic analysis of a trojan that is known to check for the presence of analysis tools (e.g., Wireshark, ProcMon) and alter its behavior if they are detected. The analyst needs to observe the malware's true behavior. Which approach is most effective?

Disable the malware's anti-analysis checks by patching the binary before execution.

Run the malware in a VM without any monitoring tools and rely on the VM's snapshot to revert after analysis.

Use a kernel-level monitoring tool that is harder for the malware to detect, and rename or hide user-mode tools.

Use the same tools but run them from a network share to avoid detection.

What is the purpose of behavioral observation and logging during malware analysis?

To build a profile of the malware's actions for detection and mitigation

To calculate the malware's hash

To determine the malware's programming language

To identify the malware's author

Which action is part of behavioral observation and logging?

Recording the malware's network connections to external IPs

Extracting strings from the binary

Examining the malware's PE section names

A malware sample is packed with a custom packer. The analyst has identified the original entry point (OEP) by setting a breakpoint on `VirtualProtect` and observing a `jmp` instruction to a new code section. What is the next best step to obtain a usable unpacked binary for static analysis?

Use a strings utility on the original packed binary to find the unpacked code.

Dump the process memory at the OEP and rebuild the import table using an import reconstruction tool.

Run the sample again and use a network sniffer to capture the unpacked payload from the network traffic.

Submit the packed binary to an online unpacking service and wait for the result.

GIAC Certified Enterprise Defender

Domain 3Objective 2

Interactive and Manual Malware Analyses GCED Practice Questions (Page 2)

Part of the Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

11concepts

Questions 6–10

6expert · hard
An analyst is performing dynamic analysis of a trojan that is known to check for the presence of analysis tools (e.g., Wireshark, ProcMon) and alter its behavior if they are detected. The analyst needs to observe the malware's true behavior. Which approach is most effective?
Select an answer first
7foundation · easy
What is the purpose of behavioral observation and logging during malware analysis?
Select an answer first
8foundation · easy
Which tool is commonly used for interactive malware analysis to step through code and set breakpoints?
Select an answer first
9foundation · easy
Which action is part of behavioral observation and logging?
Select an answer first
10application · medium
A malware sample is packed with a custom packer. The analyst has identified the original entry point (OEP) by setting a breakpoint on `VirtualProtect` and observing a `jmp` instruction to a new code section. What is the next best step to obtain a usable unpacked binary for static analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.