A malware analyst is analyzing a sample that appears to be packed. The analyst wants to extract the original code for static analysis. Which approach is most likely to succeed?

Use a hex editor to view the raw bytes of the packed file

Run the sample in a sandbox and dump the process memory after unpacking

Disassemble the packed binary directly

A security analyst at a mid-sized firm notices that multiple users have received emails with a PDF attachment that, when opened, displays a fake login prompt. After credentials are entered, the attacker uses them to access the corporate VPN. Later, the analyst finds that the PDF also dropped a small executable that modifies the Windows Registry Run key to start a process at every user logon. Which combination of malware categories and delivery mechanisms best describes this attack?

Worm delivered via drive-by download, with persistence via scheduled tasks

Spyware delivered via malvertising, with persistence via startup folder

Trojan delivered via phishing, with a persistence mechanism via registry modification

Ransomware delivered via exploit kit, with persistence via Windows service

A security team is investigating a workstation that was infected after a user clicked a link in a phishing email. The malware downloaded a second-stage payload, created a scheduled task for persistence, and then began encrypting files. Which sequence best represents the malware lifecycle stages observed?

Delivery, infection, execution, persistence, objective

Execution, persistence, delivery, infection, objective

Reconnaissance, weaponization, delivery, exploitation

Infection, persistence, execution, delivery, objective

GIAC Offensive AI Analyst

Domain 3Objective 1

Malware Fundamentals GOAA Practice Questions (Page 3)

Part of the AI-Enhanced Malware and Deepfakes domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

6concepts

Questions 11–15

11expert · hard
A malware analyst is analyzing a sample that appears to be packed. The analyst wants to extract the original code for static analysis. Which approach is most likely to succeed?
Select an answer first
12application · medium
A security analyst at a mid-sized firm notices that multiple users have received emails with a PDF attachment that, when opened, displays a fake login prompt. After credentials are entered, the attacker uses them to access the corporate VPN. Later, the analyst finds that the PDF also dropped a small executable that modifies the Windows Registry Run key to start a process at every user logon. Which combination of malware categories and delivery mechanisms best describes this attack?
Select an answer first
13foundation · easy
Which malware delivery mechanism automatically exploits vulnerabilities in a user's browser or plugins when they visit a compromised website?
Select an answer first
14application · medium
A user reports that after visiting a compromised website, their browser automatically downloaded and executed a file without any interaction. The file then installed a backdoor. Which delivery mechanism and malware type are involved?
Select an answer first
15application · medium
A security team is investigating a workstation that was infected after a user clicked a link in a phishing email. The malware downloaded a second-stage payload, created a scheduled task for persistence, and then began encrypting files. Which sequence best represents the malware lifecycle stages observed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOAA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOAA” is a trademark of its owner, used for identification only.

Malware Fundamentals GOAA Practice Questions (Page 3)

Questions 11–15

A malware analyst is analyzing a sample that appears to be packed. The analyst wants to extract the original code for static analysis. Which approach is most likely to succeed?

Which malware delivery mechanism automatically exploits vulnerabilities in a user's browser or plugins when they visit a compromised website?

A user reports that after visiting a compromised website, their browser automatically downloaded and executed a file without any interaction. The file then installed a backdoor. Which delivery mechanism and malware type are involved?

Keep studying — AI-Enhanced Malware and Deepfakes