Which vulnerability class is commonly exploited in malicious RTF files?

Buffer overflow in the TCP/IP stack

Cross-site scripting (XSS) in web browsers

Equation Editor vulnerabilities (e.g., CVE-2017-11882)

An analyst is developing a custom RTF parser to extract embedded objects from malicious files. The parser currently fails on files that use unusual encoding, such as hex-encoded control words or obfuscated group delimiters. Which improvement is most effective?

Implement a state machine that handles RTF control words and groups, including hex-encoded characters and nested groups.

Increase the parser's recursion limit.

Use a simple regex to find all '\object' occurrences.

Use a third-party library without modification.

GIAC Reverse Engineering Malware

Domain 4Objective 3

Analyzing Malicious RTF Files GREM Practice Questions (Page 10)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 46–47

46foundation · easy
Which vulnerability class is commonly exploited in malicious RTF files?
Select an answer first
47expert · hard
An analyst is developing a custom RTF parser to extract embedded objects from malicious files. The parser currently fails on files that use unusual encoding, such as hex-encoded control words or obfuscated group delimiters. Which improvement is most effective?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Analyzing Malicious RTF Files GREM Practice Questions (Page 10)

Questions 46–47

Which vulnerability class is commonly exploited in malicious RTF files?

An analyst is developing a custom RTF parser to extract embedded objects from malicious files. The parser currently fails on files that use unusual encoding, such as hex-encoded control words or obfuscated group delimiters. Which improvement is most effective?

Keep studying — Document and File Analysis