During dynamic analysis of a malware sample in a sandbox, the analyst observes that the sample creates a mutex named 'Global\MSUpdate', writes a file to %AppData%\Temp\svchost.exe, and then attempts to connect to an IP address on port 443. Which combination of dynamic analysis techniques would best confirm the malware's persistence mechanism and command-and-control (C2) communication?

Only capture network traffic with tcpdump

Use a debugger to step through the unpacking routine

Submit the file to VirusTotal for multi-engine detection

Monitor registry and file system changes, and capture network traffic

Which static analysis technique involves examining a file's metadata, such as compilation timestamps, section names, and imported functions, without executing the file?

Monitoring network traffic during execution

Reviewing file properties and headers

Observing registry changes after execution

A ransomware incident occurs on a Windows server. The incident response team needs to identify the malware family to determine the appropriate response. Which combination of analysis techniques would provide the most reliable identification?

Static analysis of the binary's strings and imports, followed by dynamic analysis in a sandbox.

Only dynamic analysis in a sandbox to observe network connections.

Use an AI-based classifier that only examines file metadata.

Only static analysis of the binary's strings and imports.

Which of the following is a key component of a dynamic analysis environment designed to safely observe malware behavior?

A hex editor for viewing binary data

A hash calculator for file integrity

A disassembler for reading assembly code

A sandbox with network monitoring

A security team uses an AI-based malware classifier that relies on static features such as file size, entropy, and import table. The classifier has a high false-negative rate for packed malware. What is the most likely reason?

The classifier uses dynamic analysis features.

Packed malware has high entropy and unusual import tables, which the classifier may not have seen in training.

The classifier is not updated with the latest signatures.

Packed malware is always detected by static analysis.

GIAC Certified Incident Handler

Domain 1Objective 3

Malware and AI Assisted Investigations GCIH Practice Questions (Page 5)

Part of the Incident Response and Investigation domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 21–25

21application · medium
During dynamic analysis of a malware sample in a sandbox, the analyst observes that the sample creates a mutex named 'Global\MSUpdate', writes a file to %AppData%\Temp\svchost.exe, and then attempts to connect to an IP address on port 443. Which combination of dynamic analysis techniques would best confirm the malware's persistence mechanism and command-and-control (C2) communication?
Select an answer first
22foundation · easy
Which static analysis technique involves examining a file's metadata, such as compilation timestamps, section names, and imported functions, without executing the file?
Select an answer first
23application · medium
A ransomware incident occurs on a Windows server. The incident response team needs to identify the malware family to determine the appropriate response. Which combination of analysis techniques would provide the most reliable identification?
Select an answer first
24foundation · easy
Which of the following is a key component of a dynamic analysis environment designed to safely observe malware behavior?
Select an answer first
25application · medium
A security team uses an AI-based malware classifier that relies on static features such as file size, entropy, and import table. The classifier has a high false-negative rate for packed malware. What is the most likely reason?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.