A malware analyst needs to run a suspicious binary that is known to attempt outbound connections. The lab has a dedicated analysis VM with no network access, but the analyst wants to observe the malware's network behavior without allowing it to reach the internet. Which approach should the analyst take?

Use a public malware analysis service that provides internet access to the sample.

Disable the VM's network adapter entirely and run the malware.

Run the malware on the host machine with a firewall blocking all outbound traffic.

Use a virtual network with a fake DNS and HTTP server that logs requests, while blocking external routes.

An analyst has a suspicious binary that is packed. The analyst needs to determine the original code's functionality. Which approach is most appropriate as a first step?

Delete the binary and rely on network signatures.

Immediately disassemble the binary and read the assembly.

Use a packer detection tool to identify the packer, then unpack the binary statically or dynamically.

Run the binary in a sandbox and rely solely on dynamic analysis.

A malware analyst is reviewing a sample that communicates with a domain that is registered with a privacy service and uses a dynamic DNS provider. The analyst wants to create indicators that will be useful for network hunting over the next few weeks. Which combination of indicators would be most resilient to the domain being taken down?

The file's compilation timestamp and the PE section names.

The domain name and the IP address resolved at the time of analysis.

The user-agent string and the HTTP headers used in requests.

The malware's file hash and the TLS certificate fingerprint used for its C2 communication.

Which file property is most commonly used to uniquely identify a malware sample and can be shared as an indicator of compromise?

Cryptographic hash (e.g., MD5, SHA-1, SHA-256)

A malware analyst wants to extract readable text from a suspicious binary to look for URLs, file paths, or command-line arguments. Which basic static analysis technique is most appropriate?

Running the binary in a debugger

GIAC Certified Enterprise Defender

Domain 3Objective 1

Malware Analysis Concepts and Basic Analysis Techniques GCED Practice Questions (Page 4)

Part of the Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 16–20

16application · medium
A malware analyst needs to run a suspicious binary that is known to attempt outbound connections. The lab has a dedicated analysis VM with no network access, but the analyst wants to observe the malware's network behavior without allowing it to reach the internet. Which approach should the analyst take?
Select an answer first
17application · medium
An analyst has a suspicious binary that is packed. The analyst needs to determine the original code's functionality. Which approach is most appropriate as a first step?
Select an answer first
18expert · hard
A malware analyst is reviewing a sample that communicates with a domain that is registered with a privacy service and uses a dynamic DNS provider. The analyst wants to create indicators that will be useful for network hunting over the next few weeks. Which combination of indicators would be most resilient to the domain being taken down?
Select an answer first
19foundation · easy
Which file property is most commonly used to uniquely identify a malware sample and can be shared as an indicator of compromise?
Select an answer first
20foundation · easy
A malware analyst wants to extract readable text from a suspicious binary to look for URLs, file paths, or command-line arguments. Which basic static analysis technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.

Malware Analysis Concepts and Basic Analysis Techniques GCED Practice Questions (Page 4)

Questions 16–20

An analyst has a suspicious binary that is packed. The analyst needs to determine the original code's functionality. Which approach is most appropriate as a first step?

Which file property is most commonly used to uniquely identify a malware sample and can be shared as an indicator of compromise?

A malware analyst wants to extract readable text from a suspicious binary to look for URLs, file paths, or command-line arguments. Which basic static analysis technique is most appropriate?

Keep studying — Malware Analysis