During an incident response, you find that a malware sample uses multiple persistence mechanisms: a registry Run key, a scheduled task, and a Windows service. The team wants to remove the malware and prevent it from running again. Which approach is most appropriate?

Delete the malware executable from disk

Disable the Windows service only

Remove all identified persistence mechanisms and then reboot the system

A forensic analyst is investigating a compromised Windows workstation. The analyst finds that a malicious DLL is loaded by a legitimate service every time the system boots. The service is configured to start automatically and runs with SYSTEM privileges. Which persistence technique is being used?

Service creation or modification

A security analyst is analyzing a suspicious document that was delivered via email. The document contains a macro that, when enabled, downloads and executes a payload. The payload is a packed executable that checks for the presence of a debugger and delays execution if the system has less than 2 GB of RAM. Which evasion techniques are being used?

Anti-debugging, anti-sandboxing, and obfuscation

Packing, anti-sandboxing, and code signing

Obfuscation, anti-VM, and anti-debugging

Packing, anti-debugging, and anti-sandboxing

GIAC Offensive AI Analyst

Domain 3Objective 1

Malware Fundamentals GOAA Practice Questions (Page 6)

Part of the AI-Enhanced Malware and Deepfakes domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

6concepts

Questions 26–30

26expert · hard
During an incident response, you find that a malware sample uses multiple persistence mechanisms: a registry Run key, a scheduled task, and a Windows service. The team wants to remove the malware and prevent it from running again. Which approach is most appropriate?
Select an answer first
27application · medium
A forensic analyst is investigating a compromised Windows workstation. The analyst finds that a malicious DLL is loaded by a legitimate service every time the system boots. The service is configured to start automatically and runs with SYSTEM privileges. Which persistence technique is being used?
Select an answer first
28foundation · easy
A malware sample checks for the presence of debugging tools or virtual machine artifacts and delays execution if detected. Which evasion technique does this describe?
Select an answer first
29application · medium
A security analyst is analyzing a suspicious document that was delivered via email. The document contains a macro that, when enabled, downloads and executes a payload. The payload is a packed executable that checks for the presence of a debugger and delays execution if the system has less than 2 GB of RAM. Which evasion techniques are being used?
Select an answer first
30foundation · easy
Which evasion technique involves modifying the malware's code to change its signature while preserving its functionality, often to avoid signature-based detection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOAA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOAA” is a trademark of its owner, used for identification only.

Malware Fundamentals GOAA Practice Questions (Page 6)

Questions 26–30

During an incident response, you find that a malware sample uses multiple persistence mechanisms: a registry Run key, a scheduled task, and a Windows service. The team wants to remove the malware and prevent it from running again. Which approach is most appropriate?

A forensic analyst is investigating a compromised Windows workstation. The analyst finds that a malicious DLL is loaded by a legitimate service every time the system boots. The service is configured to start automatically and runs with SYSTEM privileges. Which persistence technique is being used?

A malware sample checks for the presence of debugging tools or virtual machine artifacts and delays execution if detected. Which evasion technique does this describe?

Which evasion technique involves modifying the malware's code to change its signature while preserving its functionality, often to avoid signature-based detection?

Keep studying — AI-Enhanced Malware and Deepfakes