An analyst is debugging a malware sample that unpacks itself in memory. The analyst has set a breakpoint on the `VirtualAlloc` function and is stepping through the code. The malware calls `VirtualAlloc` with the `PAGE_EXECUTE_READWRITE` protection flag. What is the most significant security implication of this observation, and what should the analyst do next?

The memory region is writable and executable, which is a strong sign of unpacking or self-modifying code; the analyst should set a breakpoint on the return address to catch the unpacked code.

The malware is using a heap spray technique; the analyst should look for a large number of NOP sleds in the allocated memory.

The malware is using a return-oriented programming (ROP) chain; the analyst should look for gadgets in the allocated memory.

The malware is attempting to bypass ASLR; the analyst should check the base address of the allocation.

An analyst is debugging a packed malware sample. The malware uses anti-debugging techniques, including `IsDebuggerPresent` and `PEB.BeingDebugged` checks. The analyst needs to bypass these checks to reach the unpacking routine. Which approach is most effective?

Patch the `IsDebuggerPresent` function to return zero and modify the PEB.BeingDebugged flag to zero in the debugger.

Run the sample in a debugger and ignore the anti-debugging messages, hoping the unpacking routine still executes.

Use a process monitor to log the malware's file and registry activity, and infer the unpacking routine from the logs.

Use a network sniffer to capture the unpacked payload from the malware's network traffic.

An analyst has completed an interactive analysis of a rootkit and needs to document the findings. The rootkit uses a kernel driver to hide processes and files. The analyst has identified the driver's file name, the registry service key, and the SHA-256 hash. Which additional information is most important to include in the report for the detection team?

The kernel driver's digital signature status and the certificate details, if any.

The exact memory addresses where the rootkit hooks system calls.

The analysis VM's network configuration and IP address.

The full list of processes that were hidden during the analysis.

An analyst has finished analyzing a banking trojan and needs to write a report for the incident response team. The report should allow the team to detect the malware on other systems and understand its behavior. Which section is most critical to include?

A step-by-step log of every keystroke the analyst made during analysis.

A list of all tools used, with version numbers.

A detailed description of the analysis environment, including VM snapshots.

A list of IOCs such as file hashes, registry keys, and C2 domains.

GIAC Certified Enterprise Defender

Domain 3Objective 2

Interactive and Manual Malware Analyses GCED Practice Questions (Page 5)

Part of the Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

11concepts

Questions 21–25

21application · hard
An analyst is debugging a malware sample that unpacks itself in memory. The analyst has set a breakpoint on the `VirtualAlloc` function and is stepping through the code. The malware calls `VirtualAlloc` with the `PAGE_EXECUTE_READWRITE` protection flag. What is the most significant security implication of this observation, and what should the analyst do next?
Select an answer first
22expert · hard
An analyst is debugging a packed malware sample. The malware uses anti-debugging techniques, including `IsDebuggerPresent` and `PEB.BeingDebugged` checks. The analyst needs to bypass these checks to reach the unpacking routine. Which approach is most effective?
Select an answer first
23expert · hard
An analyst has completed an interactive analysis of a rootkit and needs to document the findings. The rootkit uses a kernel driver to hide processes and files. The analyst has identified the driver's file name, the registry service key, and the SHA-256 hash. Which additional information is most important to include in the report for the detection team?
Select an answer first
24application · medium
An analyst has finished analyzing a banking trojan and needs to write a report for the incident response team. The report should allow the team to detect the malware on other systems and understand its behavior. Which section is most critical to include?
Select an answer first
25foundation · easy
Which tool is most appropriate for code tracing and debugging malware?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.

Interactive and Manual Malware Analyses GCED Practice Questions (Page 5)

Questions 21–25

An analyst is debugging a packed malware sample. The malware uses anti-debugging techniques, including `IsDebuggerPresent` and `PEB.BeingDebugged` checks. The analyst needs to bypass these checks to reach the unpacking routine. Which approach is most effective?

An analyst has finished analyzing a banking trojan and needs to write a report for the incident response team. The report should allow the team to detect the malware on other systems and understand its behavior. Which section is most critical to include?

Which tool is most appropriate for code tracing and debugging malware?

Keep studying — Malware Analysis