During an incident response, an analyst discovers that malware persists by creating a Windows service and a scheduled task. The analyst also finds that the malware modifies the registry to disable Windows Defender. The team needs to remove the malware and prevent reinfection. Which remediation approach is most comprehensive?

Disable the service and scheduled task, and reboot the system

Delete the service and scheduled task, restore the registry, and run a full antivirus scan

Run a full antivirus scan and delete the service

Restore the registry from a backup and reboot

Which of the following is a common persistence technique used by malware to automatically start when a user logs in?

Modifying the Windows Registry Run key

A security team is investigating a series of intrusions. In each case, the initial access was via a phishing email with a malicious attachment. After execution, the malware created a Windows service that runs a script every time the system boots. The script then downloads additional payloads from a remote server. The team needs to disrupt the attack chain at the earliest possible stage with the least effort. Which action would be most effective?

Block the phishing email domain at the email gateway

Disable the malicious Windows service on affected hosts

Deploy an EDR solution to detect the script

Add the remote server's IP to the firewall blocklist

A forensic analyst is investigating a system where malware persists across reboots. The analyst finds a scheduled task that runs a malicious script at logon, and a Windows service that starts automatically. Which two persistence mechanisms are present?

Scheduled task and DLL hijacking

Registry run key and scheduled task

GIAC Offensive AI Analyst

Domain 3Objective 1

Malware Fundamentals GOAA Practice Questions (Page 2)

Part of the AI-Enhanced Malware and Deepfakes domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

6concepts

Questions 6–10

6application · easy
A forensic analyst is investigating a system where malware persists by creating a scheduled task that runs a script every 5 minutes. The script downloads and executes additional payloads. Which persistence mechanism is being used?
Select an answer first
7expert · hard
During an incident response, an analyst discovers that malware persists by creating a Windows service and a scheduled task. The analyst also finds that the malware modifies the registry to disable Windows Defender. The team needs to remove the malware and prevent reinfection. Which remediation approach is most comprehensive?
Select an answer first
8foundation · easy
Which of the following is a common persistence technique used by malware to automatically start when a user logs in?
Select an answer first
9expert · hard
A security team is investigating a series of intrusions. In each case, the initial access was via a phishing email with a malicious attachment. After execution, the malware created a Windows service that runs a script every time the system boots. The script then downloads additional payloads from a remote server. The team needs to disrupt the attack chain at the earliest possible stage with the least effort. Which action would be most effective?
Select an answer first
10application · medium
A forensic analyst is investigating a system where malware persists across reboots. The analyst finds a scheduled task that runs a malicious script at logon, and a Windows service that starts automatically. Which two persistence mechanisms are present?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOAA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOAA” is a trademark of its owner, used for identification only.

Malware Fundamentals GOAA Practice Questions (Page 2)

Questions 6–10

A forensic analyst is investigating a system where malware persists by creating a scheduled task that runs a script every 5 minutes. The script downloads and executes additional payloads. Which persistence mechanism is being used?

Which of the following is a common persistence technique used by malware to automatically start when a user logs in?

A forensic analyst is investigating a system where malware persists across reboots. The analyst finds a scheduled task that runs a malicious script at logon, and a Windows service that starts automatically. Which two persistence mechanisms are present?

Keep studying — AI-Enhanced Malware and Deepfakes