An analyst needs to observe the behavior of a suspected trojan in a controlled environment. The analyst has a Windows VM with network access to a fake DNS server and a simulated internet service. Which tool combination would best capture the trojan's file system, registry, and network activities during execution?

Wireshark and a registry editor

Process Monitor (ProcMon) and Wireshark

Process Explorer and Task Manager

A network sniffer and a file integrity checker

A security team has a suspected malware sample that is time-sensitive because the attacker is actively using it in the network. The team needs to produce actionable indicators quickly, but the sample is packed and requires unpacking to perform deeper static analysis. The team has a sandbox available but limited time. Which approach should the team take to obtain useful indicators fastest?

Use a debugger to step through the unpacking routine and then analyze the unpacked code.

Run the sample in the sandbox and capture network and file system activity, then use those indicators for hunting.

Spend time manually unpacking the sample to perform static analysis first.

Submit the sample to an online multi-engine scanner and wait for the report.

An analyst is about to run a suspected keylogger in a sandbox. The analyst wants to capture the keystrokes the malware logs and any files it writes. Which tool configuration would best achieve this?

Use a debugger to step through the keylogger's code and observe variables.

Use Process Monitor to log file writes and a custom script to simulate keystrokes in the VM.

Use a registry monitor to see if the keylogger modifies startup keys.

Use Wireshark to capture network traffic and look for keystroke data.

A malware sample is observed to create a mutex named 'Global\UniqueMutex123' and then spawn a child process that connects to an external IP address. Which two behaviors should the analyst document as indicators?

Persistence mechanism and privilege escalation

File deletion and registry modification

Mutex creation and network connection

Process injection and service creation

A malware analyst needs to analyze a worm that spreads via SMB. The analyst has a sandbox VM that is connected to a virtual network with other VMs. What is the most important configuration to prevent the worm from escaping the sandbox environment?

Use a snapshot before execution so the VM can be reverted.

Ensure the virtual network is isolated from the host and production networks.

Disable the VM's network adapter after the worm has been executed.

Run the VM with limited CPU and memory resources.

GIAC Certified Enterprise Defender

Domain 3Objective 1

Malware Analysis Concepts and Basic Analysis Techniques GCED Practice Questions (Page 3)

Part of the Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 11–15

11application · medium
An analyst needs to observe the behavior of a suspected trojan in a controlled environment. The analyst has a Windows VM with network access to a fake DNS server and a simulated internet service. Which tool combination would best capture the trojan's file system, registry, and network activities during execution?
Select an answer first
12expert · hard
A security team has a suspected malware sample that is time-sensitive because the attacker is actively using it in the network. The team needs to produce actionable indicators quickly, but the sample is packed and requires unpacking to perform deeper static analysis. The team has a sandbox available but limited time. Which approach should the team take to obtain useful indicators fastest?
Select an answer first
13application · medium
An analyst is about to run a suspected keylogger in a sandbox. The analyst wants to capture the keystrokes the malware logs and any files it writes. Which tool configuration would best achieve this?
Select an answer first
14application · easy
A malware sample is observed to create a mutex named 'Global\UniqueMutex123' and then spawn a child process that connects to an external IP address. Which two behaviors should the analyst document as indicators?
Select an answer first
15application · medium
A malware analyst needs to analyze a worm that spreads via SMB. The analyst has a sandbox VM that is connected to a virtual network with other VMs. What is the most important configuration to prevent the worm from escaping the sandbox environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.

Malware Analysis Concepts and Basic Analysis Techniques GCED Practice Questions (Page 3)

Questions 11–15

An analyst is about to run a suspected keylogger in a sandbox. The analyst wants to capture the keystrokes the malware logs and any files it writes. Which tool configuration would best achieve this?

A malware sample is observed to create a mutex named 'Global\UniqueMutex123' and then spawn a child process that connects to an external IP address. Which two behaviors should the analyst document as indicators?

A malware analyst needs to analyze a worm that spreads via SMB. The analyst has a sandbox VM that is connected to a virtual network with other VMs. What is the most important configuration to prevent the worm from escaping the sandbox environment?

Keep studying — Malware Analysis