An analyst is executing a ransomware sample in a sandbox. The analyst wants to identify which files the ransomware encrypts and whether it attempts to delete shadow copies. Which tool would provide the most comprehensive view of these file system activities?

Process Monitor with file and registry monitoring enabled.

A network sniffer to capture outbound traffic.

A file integrity monitor that checks hashes before and after execution.

A debugger to step through the ransomware's encryption routine.

During dynamic analysis, a malware sample is observed to create a scheduled task that runs a PowerShell script every hour. The script downloads and executes a payload from a remote server. Which two behaviors should be documented as the most critical indicators?

Scheduled task creation and network download

Service creation and DLL injection

Process injection and privilege escalation

Registry modification and file deletion

Which statement correctly distinguishes static analysis from dynamic analysis of malware?

Static analysis requires an isolated environment, while dynamic analysis can be performed on any system.

Static analysis examines the binary without executing it, while dynamic analysis runs the malware and observes its behavior.

Static analysis is only used for network traffic, while dynamic analysis is used for files.

Static analysis executes the malware in a virtual machine, while dynamic analysis inspects the binary without running it.

During malware analysis, an analyst finds a suspicious string in the binary that appears to be a domain name used for command-and-control communication. How is this string best classified?

As a static analysis artifact only

As a network-based indicator of compromise

As a host-based indicator of compromise

After analyzing a malware sample, an analyst has identified a unique domain, a file hash, and a registry key that the malware creates. Which of these indicators is most useful for detecting the malware on other hosts in the environment?

The file hash, because it uniquely identifies the exact malware file.

All are equally useful for host-based detection.

The unique domain, because it can be used to monitor network traffic.

The registry key, because it indicates persistence.

GIAC Certified Enterprise Defender

Domain 3Objective 1

Malware Analysis Concepts and Basic Analysis Techniques GCED Practice Questions (Page 2)

Part of the Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 6–10

6application · medium
An analyst is executing a ransomware sample in a sandbox. The analyst wants to identify which files the ransomware encrypts and whether it attempts to delete shadow copies. Which tool would provide the most comprehensive view of these file system activities?
Select an answer first
7expert · medium
During dynamic analysis, a malware sample is observed to create a scheduled task that runs a PowerShell script every hour. The script downloads and executes a payload from a remote server. Which two behaviors should be documented as the most critical indicators?
Select an answer first
8foundation · easy
Which statement correctly distinguishes static analysis from dynamic analysis of malware?
Select an answer first
9foundation · easy
During malware analysis, an analyst finds a suspicious string in the binary that appears to be a domain name used for command-and-control communication. How is this string best classified?
Select an answer first
10application · medium
After analyzing a malware sample, an analyst has identified a unique domain, a file hash, and a registry key that the malware creates. Which of these indicators is most useful for detecting the malware on other hosts in the environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.