An analyst has completed an interactive malware analysis and needs to write a report for a security operations center (SOC) that will use the findings to create detection rules. Which report structure is most appropriate?

A summary of the malware's family and a link to a public sandbox report.

A list of all files and registry keys changed on the analysis VM, sorted by timestamp.

A detailed log of every API call made during the analysis, with no interpretation.

Executive summary, analysis environment, static and dynamic analysis findings, IOCs, and recommended detection/mitigation steps.

Which scenario best illustrates interactive malware analysis?

Submitting a sample to an online multi-scanner and reviewing the aggregated results

An analyst sets breakpoints in a debugger and steps through the malware's code to understand its decryption routine

A security appliance quarantines a file based on signature matching

Running a sample in a sandbox and receiving a score from a reputation service

What is the primary reason for using an isolated environment for malware analysis?

To prevent the malware from spreading to other systems

To allow the malware to access the internet freely

To speed up the analysis process

What is an indicator of compromise (IOC)?

A piece of evidence that suggests a system may be compromised

GIAC Certified Enterprise Defender

Domain 3Objective 2

Interactive and Manual Malware Analyses GCED Practice Questions (Page 9)

Part of the Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

11concepts

Questions 41–45

41application · medium
An analyst has completed an interactive malware analysis and needs to write a report for a security operations center (SOC) that will use the findings to create detection rules. Which report structure is most appropriate?
Select an answer first
42application · medium
An analyst is performing dynamic analysis of a worm in a VM. The analyst wants to observe the malware's file system and registry activities in real time. Which tool should the analyst use to capture these activities?
Select an answer first
43foundation · easy
Which scenario best illustrates interactive malware analysis?
Select an answer first
44foundation · easy
What is the primary reason for using an isolated environment for malware analysis?
Select an answer first
45foundation · easy
What is an indicator of compromise (IOC)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.