GIAC Reverse Engineering Malware
Domain 3Objective 2
Analyzing Obfuscated Malware GREM Practice Questions (Page 9)
Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)
43questions here
9free pages
8concepts
Questions 41–43
- 41
An analyst wants to step through the unpacking routine of a malware sample instruction by instruction to understand how it works. Which type of tool is most appropriate for this task?
Select an answer first - 42
A malware sample checks for the presence of specific registry keys and processes that are commonly found in virtual machines, such as VMware Tools. Which anti-analysis technique is this?
Select an answer first - 43
An analyst extracts printable strings from a packed malware sample and finds only a few short strings such as 'UPX0' and 'UPX1'. What does this observation suggest?
Select an answer first
Finished these 3 questions?
Review the revealed explanations, or continue through the curriculum.
No more pagesBack to GREM
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.