Which technique is used to handle obfuscated malware during interactive analysis?

Deobfuscation to restore readable code

Ignoring the obfuscation and relying on network signatures

Running the malware on a production server to observe its behavior

A malware analyst receives a suspicious binary and runs `strings` on it. The output shows very few readable strings, and the file's entropy is high. The PE section names are `.UPX0`, `.UPX1`, and `.UPX2`. What should the analyst do next to best understand the binary's functionality?

Run the binary in a sandbox and rely on the automated report to identify its behavior.

Use a hex editor to manually decode the strings from the raw binary data.

Attempt to unpack the binary using a UPX unpacker or manual unpacking in a debugger, then re-run static analysis.

Submit the file hash to VirusTotal and wait for the report.

A malware analyst is performing dynamic analysis of a sample that is known to download a second-stage payload. The analyst wants to capture the payload and observe the malware's network behavior. Which combination of tools is most appropriate for this task?

A memory dump tool and a strings utility to extract the payload from memory after execution.

A network sniffer (e.g., Wireshark) and a fake HTTP server (e.g., INetSim) to emulate network services and capture the download.

A firewall log and a DNS log from the host machine.

A debugger and a process monitor to trace the malware's API calls and file writes.

An analyst is analyzing a malware sample that uses a custom packer and contains anti-debugging code that detects software breakpoints by checking for `0xCC` bytes in its own code. The analyst needs to trace the unpacking routine. Which debugging technique is most appropriate to avoid detection?

Use software breakpoints but patch the anti-debugging check to always return false.

Use a process monitor to trace the unpacking routine without setting breakpoints.

Use a network sniffer to capture the unpacked payload from the malware's network traffic.

Use hardware breakpoints instead of software breakpoints to avoid `0xCC` byte detection.

What is the purpose of code tracing in malware analysis?

To understand the control flow and identify key routines

To determine the malware's file type

To extract IOCs from the binary

To calculate the malware's hash

GIAC Certified Enterprise Defender

Domain 3Objective 2

Interactive and Manual Malware Analyses GCED Practice Questions (Page 6)

Part of the Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

11concepts

Questions 26–30

26foundation · easy
Which technique is used to handle obfuscated malware during interactive analysis?
Select an answer first
27application · medium
A malware analyst receives a suspicious binary and runs `strings` on it. The output shows very few readable strings, and the file's entropy is high. The PE section names are `.UPX0`, `.UPX1`, and `.UPX2`. What should the analyst do next to best understand the binary's functionality?
Select an answer first
28application · medium
A malware analyst is performing dynamic analysis of a sample that is known to download a second-stage payload. The analyst wants to capture the payload and observe the malware's network behavior. Which combination of tools is most appropriate for this task?
Select an answer first
29expert · hard
An analyst is analyzing a malware sample that uses a custom packer and contains anti-debugging code that detects software breakpoints by checking for `0xCC` bytes in its own code. The analyst needs to trace the unpacking routine. Which debugging technique is most appropriate to avoid detection?
Select an answer first
30foundation · easy
What is the purpose of code tracing in malware analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.