A security analyst is examining a suspicious executable that is packed and uses anti-sandboxing. The executable is believed to be a trojan. The analyst needs to determine the malware's capabilities and C2 infrastructure. Which analysis approach is most appropriate?

Perform dynamic analysis in a controlled environment with network monitoring, then perform static analysis on the unpacked binary

Run the executable in a standard sandbox without network monitoring

Use a debugger to step through the unpacking routine

Perform static analysis on the packed binary and extract strings

A malware sample is being analyzed. Static analysis reveals that the sample uses a custom packer and contains many junk instructions. When executed in a sandbox, the sample sleeps for 10 minutes before performing any network activity. Which evasion techniques are being used?

Obfuscation, anti-sandboxing, and code signing

Packing, anti-sandboxing, and anti-debugging

Packing, obfuscation, and anti-sandboxing

Packing, anti-debugging, and anti-VM

A malware analyst is analyzing a sample that uses anti-sandboxing techniques. The sample checks for the presence of analysis tools and delays execution if it detects them. The analyst needs to obtain a behavioral analysis of the sample. Which approach is most likely to succeed?

Patch the sample to disable the anti-sandboxing checks

Run the sample on a bare-metal machine without any monitoring

Use a standard sandbox and wait for the sample to execute

Use a custom sandbox that mimics a real user environment and hides analysis tools

GIAC Offensive AI Analyst

Domain 3Objective 1

Malware Fundamentals GOAA Practice Questions (Page 8)

Part of the AI-Enhanced Malware and Deepfakes domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

6concepts

Questions 36–40

36application · medium
A security team discovers that a legitimate-looking executable on a user's machine is actually a remote access trojan (RAT). The RAT was delivered via a malicious link in a social media message. The RAT is packed and uses a custom protocol to communicate with a C2 server. Which two malware categories are involved?
Select an answer first
37expert · hard
A security analyst is examining a suspicious executable that is packed and uses anti-sandboxing. The executable is believed to be a trojan. The analyst needs to determine the malware's capabilities and C2 infrastructure. Which analysis approach is most appropriate?
Select an answer first
38application · medium
A malware sample is being analyzed. Static analysis reveals that the sample uses a custom packer and contains many junk instructions. When executed in a sandbox, the sample sleeps for 10 minutes before performing any network activity. Which evasion techniques are being used?
Select an answer first
39expert · hard
A malware analyst is analyzing a sample that uses anti-sandboxing techniques. The sample checks for the presence of analysis tools and delays execution if it detects them. The analyst needs to obtain a behavioral analysis of the sample. Which approach is most likely to succeed?
Select an answer first
40foundation · easy
Which malware analysis approach involves examining the executable file without running it, such as inspecting strings, imports, and file structure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOAA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOAA” is a trademark of its owner, used for identification only.

Malware Fundamentals GOAA Practice Questions (Page 8)

Questions 36–40

A security analyst is examining a suspicious executable that is packed and uses anti-sandboxing. The executable is believed to be a trojan. The analyst needs to determine the malware's capabilities and C2 infrastructure. Which analysis approach is most appropriate?

A malware sample is being analyzed. Static analysis reveals that the sample uses a custom packer and contains many junk instructions. When executed in a sandbox, the sample sleeps for 10 minutes before performing any network activity. Which evasion techniques are being used?

A malware analyst is analyzing a sample that uses anti-sandboxing techniques. The sample checks for the presence of analysis tools and delays execution if it detects them. The analyst needs to obtain a behavioral analysis of the sample. Which approach is most likely to succeed?

Which malware analysis approach involves examining the executable file without running it, such as inspecting strings, imports, and file structure?

Keep studying — AI-Enhanced Malware and Deepfakes