A security analyst at a mid-sized firm notices that several employees in finance have received emails with a link to a document-sharing site. The link downloads a file that, when opened, installs a program that encrypts local files and displays a ransom note. The emails appear to come from a known vendor but the sender domain is slightly misspelled. Which combination of malware type and delivery mechanism best describes this incident?

Spyware delivered via a malicious attachment

Trojan delivered via a drive-by download

Ransomware delivered via a phishing link

Worm delivered via an exploit kit

A company's endpoint protection flags a file that, when executed, encrypts all user documents and displays a ransom note demanding payment in cryptocurrency. The file was delivered via a malicious macro in an Excel spreadsheet attached to a phishing email. Which malware type and delivery mechanism are involved?

Spyware delivered via malvertising

Trojan delivered via drive-by download

Ransomware delivered via phishing

A malware analyst is examining a sample that uses a custom encoding scheme to hide its strings. The analyst suspects that the sample is using obfuscation. Which analysis technique would be most effective in revealing the hidden strings?

Using a disassembler to view the code

Static analysis with a hex editor

Running the strings command on the binary

Dynamic analysis with a debugger to observe the strings after decoding

GIAC Offensive AI Analyst

Domain 3Objective 1

Malware Fundamentals GOAA Practice Questions (Page 1)

Part of the AI-Enhanced Malware and Deepfakes domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

6concepts

Questions 1–5

1foundation · easy
Which persistence technique involves creating a task that runs malware at specific times or intervals?
Select an answer first
2application · medium
A security analyst at a mid-sized firm notices that several employees in finance have received emails with a link to a document-sharing site. The link downloads a file that, when opened, installs a program that encrypts local files and displays a ransom note. The emails appear to come from a known vendor but the sender domain is slightly misspelled. Which combination of malware type and delivery mechanism best describes this incident?
Select an answer first
3foundation · easy
Which type of malware is characterized by its ability to replicate and spread to other systems without requiring user action, often exploiting network vulnerabilities?
Select an answer first
4application · medium
A company's endpoint protection flags a file that, when executed, encrypts all user documents and displays a ransom note demanding payment in cryptocurrency. The file was delivered via a malicious macro in an Excel spreadsheet attached to a phishing email. Which malware type and delivery mechanism are involved?
Select an answer first
5application · medium
A malware analyst is examining a sample that uses a custom encoding scheme to hide its strings. The analyst suspects that the sample is using obfuscation. Which analysis technique would be most effective in revealing the hidden strings?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOAA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOAA” is a trademark of its owner, used for identification only.

Malware Fundamentals GOAA Practice Questions (Page 1)

Questions 1–5

Which persistence technique involves creating a task that runs malware at specific times or intervals?

Which type of malware is characterized by its ability to replicate and spread to other systems without requiring user action, often exploiting network vulnerabilities?

A malware analyst is examining a sample that uses a custom encoding scheme to hide its strings. The analyst suspects that the sample is using obfuscation. Which analysis technique would be most effective in revealing the hidden strings?

Keep studying — AI-Enhanced Malware and Deepfakes