An analyst is documenting the behavior of a ransomware sample. The analyst observes that the malware encrypts files with a .encrypted extension and drops a ransom note named 'README.txt'. The analyst also notes that the malware deletes volume shadow copies using vssadmin. Which finding should be prioritized in the report as the most critical for incident response?

The encryption of files with a .encrypted extension

The dropping of the ransom note 'README.txt'

The deletion of volume shadow copies using vssadmin

The creation of a new registry key for persistence

GIAC Reverse Engineering Malware

Domain 1Objective 2

Behavioral Analysis Fundamentals GREM Practice Questions (Page 10)

Part of the Malware Analysis Fundamentals domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

10concepts

Questions 46–46

46application · medium
An analyst is documenting the behavior of a ransomware sample. The analyst observes that the malware encrypts files with a .encrypted extension and drops a ransom note named 'README.txt'. The analyst also notes that the malware deletes volume shadow copies using vssadmin. Which finding should be prioritized in the report as the most critical for incident response?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Behavioral Analysis Fundamentals GREM Practice Questions (Page 10)

Questions 46–46

Keep studying — Malware Analysis Fundamentals