A malware analyst has a suspicious executable that is packed and obfuscated. Static analysis reveals only a small stub that unpacks the real payload in memory. To extract the actual malicious code and observe its behavior, which technique should the analyst use?

Static analysis with a disassembler to manually follow the unpacking routine and reconstruct the payload byte by byte.

Dynamic analysis in a controlled sandbox that allows the sample to unpack itself and then dump the process memory.

File signature analysis to identify the packer and then search online for a public analysis report of the same packer.

String extraction from the original binary to find hidden URLs or API calls without executing it.

Which statement best describes how malware contributes to the cyber threat intelligence (CTI) process?

Malware serves as a legal basis for prosecuting cyber criminals

Malware is used to directly block adversary attacks in real time

Malware provides raw data that, after analysis, helps identify adversary infrastructure, tools, and behaviors

Malware is primarily used to validate the effectiveness of an organization's defensive security controls

An intelligence analyst is reviewing a newly discovered trojan that uses a unique encryption key embedded in its configuration. The analyst wants to produce actionable intelligence that can help network defenders detect this threat in their environments. Which output would be most directly useful for detection?

A recommendation to block all outbound traffic on port 443 as a precautionary measure.

A summary of the encryption algorithm used, with a theoretical explanation of its cryptographic strength.

A YARA rule that matches on the trojan's unique byte pattern and a list of the C2 domains extracted from the configuration.

A detailed report on the malware author's possible country of origin based on language artifacts.

A threat intelligence analyst discovers a malware sample on a public file-sharing site and downloads it for analysis. The analyst plans to execute the sample in an isolated sandbox to observe its behavior. Which ethical or legal boundary is most important to respect?

Obtain written permission from the file-sharing site before downloading any files.

Share the sample with all employees to raise awareness of the threat.

Ensure the sandbox is fully isolated from the production network to prevent any accidental spread or harm.

Avoid analyzing the sample because it might be illegal to possess malware.

A threat intelligence team has obtained a malware sample from a third-party researcher who claims it was captured from a live botnet. The team wants to analyze the sample in a sandbox to extract C2 infrastructure. Which legal or ethical consideration is most important before proceeding?

Contact the malware author to request permission to analyze the sample.

Publish the sample on a public malware repository to help other organizations defend themselves.

Verify that the sample was obtained legally and that the team has the right to possess and analyze it under applicable laws.

Ensure the sandbox has internet access so the malware can reach its real C2 server for accurate analysis.

GIAC Cyber Threat Intelligence

Domain 2Objective 2

Malware as a Collection Source GCTI Practice Questions (Page 5)

Part of the Intelligence Collection and Storage domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 8–14 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

5concepts

Questions 21–25

21application · medium
A malware analyst has a suspicious executable that is packed and obfuscated. Static analysis reveals only a small stub that unpacks the real payload in memory. To extract the actual malicious code and observe its behavior, which technique should the analyst use?
Select an answer first
22foundation · easy
Which statement best describes how malware contributes to the cyber threat intelligence (CTI) process?
Select an answer first
23application · medium
An intelligence analyst is reviewing a newly discovered trojan that uses a unique encryption key embedded in its configuration. The analyst wants to produce actionable intelligence that can help network defenders detect this threat in their environments. Which output would be most directly useful for detection?
Select an answer first
24application · medium
A threat intelligence analyst discovers a malware sample on a public file-sharing site and downloads it for analysis. The analyst plans to execute the sample in an isolated sandbox to observe its behavior. Which ethical or legal boundary is most important to respect?
Select an answer first
25application · medium
A threat intelligence team has obtained a malware sample from a third-party researcher who claims it was captured from a live botnet. The team wants to analyze the sample in a sandbox to extract C2 infrastructure. Which legal or ethical consideration is most important before proceeding?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.