An analyst is manually analyzing a suspicious executable that is protected with a custom packer. The analyst has limited time and needs to determine the malware's capabilities without fully unpacking it. Which manual technique is most likely to provide useful information quickly?

Examine the executable's resources and overlay data for embedded files or configuration data.

Submit the binary to an online sandbox and wait for the report.

Run the executable in a debugger and step through every instruction until the unpacking is complete.

Use a generic unpacker tool that automatically unpacks the binary.

A malware analyst is examining a suspicious binary that is not recognized by any antivirus engine. The analyst wants to manually inspect the binary's structure and strings without executing it. Which approach is most appropriate for this task?

Run the binary in a sandbox and review the automated report.

Submit the binary to an online multi-scanner service for a second opinion.

Use a debugger to step through the binary's entry point.

Use a hex editor and a strings utility to examine the raw bytes and printable strings, then review the PE header with a tool like `pefile`.

Which activity is a manual malware analysis technique?

Running the sample in a sandbox and reading the network log

Using a machine learning model to classify the sample as malicious

Reviewing the file's PE header and section names in a hex editor

Uploading the sample to VirusTotal and reading the detection ratio

A security team is analyzing a malware sample that only exhibits malicious behavior when the system clock is set to a specific date. An automated sandbox report shows no malicious activity. The team needs to confirm the malware's behavior. Which approach is most appropriate?

Run the sample in the sandbox again with a longer timeout to see if the behavior eventually triggers.

Submit the sample to a third-party sandbox that uses multiple time zones.

Use static analysis to search for date-related strings and infer the trigger date, then report the malware as benign.

Perform interactive dynamic analysis, manually set the system clock to the trigger date, and observe the malware's behavior.

GIAC Certified Enterprise Defender

Domain 3Objective 2

Interactive and Manual Malware Analyses GCED Practice Questions (Page 7)

Part of the Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

11concepts

Questions 31–35

31expert · hard
An analyst is manually analyzing a suspicious executable that is protected with a custom packer. The analyst has limited time and needs to determine the malware's capabilities without fully unpacking it. Which manual technique is most likely to provide useful information quickly?
Select an answer first
32application · medium
A malware analyst is examining a suspicious binary that is not recognized by any antivirus engine. The analyst wants to manually inspect the binary's structure and strings without executing it. Which approach is most appropriate for this task?
Select an answer first
33foundation · easy
Which activity is a manual malware analysis technique?
Select an answer first
34foundation · easy
Which tool is primarily used to monitor file system, registry, and process activity in real time during dynamic analysis?
Select an answer first
35expert · hard
A security team is analyzing a malware sample that only exhibits malicious behavior when the system clock is set to a specific date. An automated sandbox report shows no malicious activity. The team needs to confirm the malware's behavior. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.