Which element should be included in a malware analysis report?

The analyst's salary information

The analyst's personal opinions

A malware analyst is asked to analyze a sample that is suspected to be a downloader. The analyst has a limited time window and needs to quickly determine what the malware downloads and from where. Which approach is most efficient?

Submit the sample to an online multi-scanner and wait for the results.

Perform dynamic analysis in an isolated VM with network simulation, and capture the traffic to identify the download URL and payload.

Perform a full static analysis of the binary, including disassembly of every function.

Run the sample on a physical machine without isolation to see what it downloads.

An analyst is using x64dbg to debug a 64-bit malware sample. The malware is known to use anti-debugging techniques, including the `IsDebuggerPresent` API. What is the most effective way to bypass this check so the malware continues running normally?

Set a breakpoint on `IsDebuggerPresent` and modify the return value (EAX) to 0 when the breakpoint hits.

Change the PE header's `Debug` directory entry to zero.

Run the malware in a VM without any debugger attached.

Use a strings utility to find the string 'IsDebuggerPresent' and remove it.

A security team has a malware sample that evades automated sandboxes by checking for the presence of a debugger and delaying execution. The team needs to understand the malware's full behavior. Why is interactive malware analysis more appropriate than fully automated analysis in this case?

Interactive analysis allows the analyst to manipulate the execution environment in real time to bypass anti-analysis checks and observe subsequent behavior.

Interactive analysis does not require an isolated environment, unlike automated analysis.

Interactive analysis is faster than automated analysis because the analyst can skip irrelevant code.

Interactive analysis automatically extracts IOCs without any manual effort.

An analyst is executing a ransomware sample in a controlled VM. The analyst wants to observe which files are encrypted and which registry keys are modified. Which tool is most appropriate for this task?

A memory forensics tool to dump the process memory and search for encryption keys.

A process monitor like ProcMon to log file system and registry activity in real time.

A debugger to step through the encryption routine and identify the encryption key.

A network sniffer to capture the ransomware's C2 communications.

GIAC Certified Enterprise Defender

Domain 3Objective 2

Interactive and Manual Malware Analyses GCED Practice Questions (Page 8)

Part of the Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

11concepts

Questions 36–40

36foundation · easy
Which element should be included in a malware analysis report?
Select an answer first
37application · medium
A malware analyst is asked to analyze a sample that is suspected to be a downloader. The analyst has a limited time window and needs to quickly determine what the malware downloads and from where. Which approach is most efficient?
Select an answer first
38application · medium
An analyst is using x64dbg to debug a 64-bit malware sample. The malware is known to use anti-debugging techniques, including the `IsDebuggerPresent` API. What is the most effective way to bypass this check so the malware continues running normally?
Select an answer first
39application · medium
A security team has a malware sample that evades automated sandboxes by checking for the presence of a debugger and delaying execution. The team needs to understand the malware's full behavior. Why is interactive malware analysis more appropriate than fully automated analysis in this case?
Select an answer first
40application · medium
An analyst is executing a ransomware sample in a controlled VM. The analyst wants to observe which files are encrypted and which registry keys are modified. Which tool is most appropriate for this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.