During dynamic analysis, an analyst observes that a malware sample makes DNS queries to a domain that was registered only yesterday. Which indicator is most useful for detecting this malware on other hosts?

The DNS query for the newly registered domain

The malware's compilation timestamp

A malware analyst has a suspicious file that is a Windows executable. The analyst wants to determine whether the file is a known malware variant and what its primary purpose is. The analyst has access to a malware sandbox and a threat intelligence platform. Which sequence of actions would be most efficient?

Run the file in the sandbox first, then compute the hash from the captured network traffic.

Compute the file hash and search the threat intelligence platform, then run the file in the sandbox if no match is found.

Disassemble the entire binary to understand its purpose before doing anything else.

Upload the file to a public malware analysis service and wait for the report.

Which of the following is a key characteristic of a properly configured malware analysis sandbox?

It is connected directly to the internet without restrictions

It uses the same credentials as the production environment

It has full access to the production network

It is isolated from the host system and has network access controlled or simulated

A malware analyst is setting up a sandbox to analyze a worm that spreads via SMB. The analyst wants to prevent the worm from escaping the sandbox and affecting the corporate network. Which configuration is essential for this sandbox?

Use a virtual machine with host-only networking and no shared folders.

Use a bridged network adapter to allow the VM to communicate with other lab VMs.

Disable the VM's network adapter and use only serial connections.

Connect the VM to the corporate network with a firewall blocking SMB ports.

GIAC Certified Enterprise Defender

Domain 3Objective 1

Malware Analysis Concepts and Basic Analysis Techniques GCED Practice Questions (Page 8)

Part of the Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 36–40

36application · easy
During dynamic analysis, an analyst observes that a malware sample makes DNS queries to a domain that was registered only yesterday. Which indicator is most useful for detecting this malware on other hosts?
Select an answer first
37application · medium
A malware analyst has a suspicious file that is a Windows executable. The analyst wants to determine whether the file is a known malware variant and what its primary purpose is. The analyst has access to a malware sandbox and a threat intelligence platform. Which sequence of actions would be most efficient?
Select an answer first
38foundation · easy
Which of the following is a key characteristic of a properly configured malware analysis sandbox?
Select an answer first
39foundation · easy
A security analyst receives a suspicious executable and needs to determine what the file does without executing it. Which approach is the analyst using?
Select an answer first
40application · medium
A malware analyst is setting up a sandbox to analyze a worm that spreads via SMB. The analyst wants to prevent the worm from escaping the sandbox and affecting the corporate network. Which configuration is essential for this sandbox?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.

Malware Analysis Concepts and Basic Analysis Techniques GCED Practice Questions (Page 8)

Questions 36–40

During dynamic analysis, an analyst observes that a malware sample makes DNS queries to a domain that was registered only yesterday. Which indicator is most useful for detecting this malware on other hosts?

Which of the following is a key characteristic of a properly configured malware analysis sandbox?

A security analyst receives a suspicious executable and needs to determine what the file does without executing it. Which approach is the analyst using?

A malware analyst is setting up a sandbox to analyze a worm that spreads via SMB. The analyst wants to prevent the worm from escaping the sandbox and affecting the corporate network. Which configuration is essential for this sandbox?

Keep studying — Malware Analysis