An analyst observes that a malware sample creates a file in the Windows startup folder and opens a network connection to an external IP address. Which two types of behavior is the analyst observing?

File system and network activity

A security analyst is examining a suspicious executable and wants to identify any embedded URLs or IP addresses without executing the file. Which tool or technique is most appropriate for this task?

Run the executable in a sandbox and use a network sniffer to capture connections.

Use a debugger to set breakpoints on network API calls.

Use the `strings` utility to extract printable strings and then filter for URL and IP patterns.

Check the file's digital signature to see if it is signed by a known vendor.

An incident responder has a suspected malware sample and needs to quickly determine if it is malicious and what it does. The responder has limited time and cannot risk executing the sample on a production system. Which approach should be taken first?

Upload the sample to a public malware analysis service without any prior local analysis.

Disassemble the binary to analyze its code flow.

Run the sample in a sandbox immediately to observe behavior.

Perform basic static analysis: compute hashes, examine strings, and review file headers.

During static analysis of a suspicious document, an analyst finds an embedded URL and a string that looks like a base64-encoded payload. The analyst wants to identify whether this document is part of a known phishing campaign. Which indicator would be most useful to search threat intelligence feeds?

The base64-encoded string alone.

The SHA-256 hash of the document file itself.

The file's creation time from metadata.

GIAC Certified Enterprise Defender

Domain 3Objective 1

Malware Analysis Concepts and Basic Analysis Techniques GCED Practice Questions (Page 5)

Part of the Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 21–25

21foundation · easy
An analyst observes that a malware sample creates a file in the Windows startup folder and opens a network connection to an external IP address. Which two types of behavior is the analyst observing?
Select an answer first
22application · medium
A security analyst is examining a suspicious executable and wants to identify any embedded URLs or IP addresses without executing the file. Which tool or technique is most appropriate for this task?
Select an answer first
23application · medium
An incident responder has a suspected malware sample and needs to quickly determine if it is malicious and what it does. The responder has limited time and cannot risk executing the sample on a production system. Which approach should be taken first?
Select an answer first
24foundation · easy
When analyzing malware behavior, which system interaction would an analyst monitor to determine if the malware maintains persistence?
Select an answer first
25application · medium
During static analysis of a suspicious document, an analyst finds an embedded URL and a string that looks like a base64-encoded payload. The analyst wants to identify whether this document is part of a known phishing campaign. Which indicator would be most useful to search threat intelligence feeds?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.

Malware Analysis Concepts and Basic Analysis Techniques GCED Practice Questions (Page 5)

Questions 21–25

An analyst observes that a malware sample creates a file in the Windows startup folder and opens a network connection to an external IP address. Which two types of behavior is the analyst observing?

A security analyst is examining a suspicious executable and wants to identify any embedded URLs or IP addresses without executing the file. Which tool or technique is most appropriate for this task?

An incident responder has a suspected malware sample and needs to quickly determine if it is malicious and what it does. The responder has limited time and cannot risk executing the sample on a production system. Which approach should be taken first?

When analyzing malware behavior, which system interaction would an analyst monitor to determine if the malware maintains persistence?

Keep studying — Malware Analysis