An analyst is about to execute a suspected trojan in a controlled lab VM. The goal is to capture file system, registry, and network activity. The analyst has already taken a snapshot of the clean VM. Which tool combination should be used to best observe the malware's behavior during execution?

An antivirus scanner and a firewall log viewer.

Process Monitor and a network capture tool such as Wireshark or tcpdump.

A registry editor and a file hash calculator.

GIAC Certified Enterprise Defender

Domain 3Objective 1

Malware Analysis Concepts and Basic Analysis Techniques GCED Practice Questions (Page 9)

Part of the Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 41–42

41application · medium
An analyst is about to execute a suspected trojan in a controlled lab VM. The goal is to capture file system, registry, and network activity. The analyst has already taken a snapshot of the clean VM. Which tool combination should be used to best observe the malware's behavior during execution?
Select an answer first
42foundation · easy
Which tool is commonly used in basic dynamic analysis to monitor registry, file system, and network activity in real time on a Windows system?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.

Malware Analysis Concepts and Basic Analysis Techniques GCED Practice Questions (Page 9)

Questions 41–42

An analyst is about to execute a suspected trojan in a controlled lab VM. The goal is to capture file system, registry, and network activity. The analyst has already taken a snapshot of the clean VM. Which tool combination should be used to best observe the malware's behavior during execution?

Which tool is commonly used in basic dynamic analysis to monitor registry, file system, and network activity in real time on a Windows system?

Keep studying — Malware Analysis