An analyst is tasked with analyzing a malware sample that is known to be polymorphic and uses anti-sandbox techniques. The analyst has limited time and needs to determine the malware's C2 infrastructure. Which approach is most appropriate?

Perform static analysis to extract the C2 domain from the binary's strings.

Use a physical machine with a network tap and run the sample directly.

Use a custom VM with anti-anti-sandbox techniques and a network proxy to capture traffic.

Run the sample in an automated sandbox and review the network traffic in the report.

An analyst is analyzing a backdoor that is suspected of establishing persistence via a Windows service. The analyst wants to confirm the service installation and identify the executable path it uses. Which tool or method would provide the most direct evidence?

Run 'netstat -ano' and look for a listening port.

Use Process Monitor with a filter for 'Operation' equals 'RegSetValue' and 'Path' contains 'Services'.

Take a Regshot snapshot before and after execution and compare the differences.

Use Wireshark to capture traffic and look for the service name in the packets.

An automated sandbox report for a malware sample shows that it creates a mutex named 'Global\MyMutex', connects to an IP address on port 443, and sends encrypted data. The report also shows that the malware modifies the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key. Which finding is most indicative of command-and-control (C2) communication?

The use of encrypted data in general

The connection to an IP address on port 443 with encrypted data

The creation of the mutex 'Global\MyMutex'

The modification of the Run registry key

During dynamic analysis of a ransomware sample, an analyst observes that a file named 'README.txt' is created in every directory where files were encrypted. The analyst wants to determine whether this file is created before or after the encryption routine begins. Which approach would provide the most reliable evidence?

Compare a Regshot snapshot taken before execution with one taken after execution.

Use Wireshark to capture network traffic and look for the file name in the packets.

Check the file's creation time in Windows Explorer after the analysis is complete.

Run the sample in a sandbox that provides a timeline of file system events with timestamps.

GIAC Reverse Engineering Malware

Domain 1Objective 2

Behavioral Analysis Fundamentals GREM Practice Questions (Page 2)

Part of the Malware Analysis Fundamentals domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

10concepts

Questions 6–10

6expert · hard
An analyst is tasked with analyzing a malware sample that is known to be polymorphic and uses anti-sandbox techniques. The analyst has limited time and needs to determine the malware's C2 infrastructure. Which approach is most appropriate?
Select an answer first
7application · medium
An analyst is analyzing a backdoor that is suspected of establishing persistence via a Windows service. The analyst wants to confirm the service installation and identify the executable path it uses. Which tool or method would provide the most direct evidence?
Select an answer first
8application · medium
An automated sandbox report for a malware sample shows that it creates a mutex named 'Global\MyMutex', connects to an IP address on port 443, and sends encrypted data. The report also shows that the malware modifies the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key. Which finding is most indicative of command-and-control (C2) communication?
Select an answer first
9foundation · easy
Which tool is specifically designed to monitor file system, registry, and process activity in real time on Windows?
Select an answer first
10application · medium
During dynamic analysis of a ransomware sample, an analyst observes that a file named 'README.txt' is created in every directory where files were encrypted. The analyst wants to determine whether this file is created before or after the encryption routine begins. Which approach would provide the most reliable evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Behavioral Analysis Fundamentals GREM Practice Questions (Page 2)

Questions 6–10

An analyst is tasked with analyzing a malware sample that is known to be polymorphic and uses anti-sandbox techniques. The analyst has limited time and needs to determine the malware's C2 infrastructure. Which approach is most appropriate?

An analyst is analyzing a backdoor that is suspected of establishing persistence via a Windows service. The analyst wants to confirm the service installation and identify the executable path it uses. Which tool or method would provide the most direct evidence?

Which tool is specifically designed to monitor file system, registry, and process activity in real time on Windows?

Keep studying — Malware Analysis Fundamentals