Behavioral Analysis Fundamentals GREM Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following best describes the role of behavioral analysis in malware analysis?

   • ATo extract the malware's embedded configuration strings
   • BTo reverse engineer the malware's encryption algorithms
   • CTo determine the malware's capabilities and impact by observing its execution
   • DTo identify the malware's author through code comments
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An analyst is reviewing a sandbox report for a sample that communicates with a domain using DNS over HTTPS (DoH). The report shows the sample makes a DoH query to 'dns.google' and then connects to an IP address. Which observation would be most useful to determine the destination of the C2 communication?

   • AThe User-Agent string in the DoH request.
   • BThe IP address that the sample connects to after the DoH query.
   • CThe TLS certificate presented by 'dns.google'.
   • DThe DNS query name inside the DoH request.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An automated sandbox report shows that a malware sample performs a DNS query for 'www.google.com' and then connects to an IP address that is not associated with Google. The analyst suspects the malware is using DNS as a communication channel. Which additional finding would most strongly support this hypothesis?

   • AThe malware connects to the IP address on port 80.
   • BThe malware sends a large amount of data in the DNS query itself.
   • CThe malware uses a hardcoded IP address for the connection.
   • DThe malware makes multiple DNS queries to different domains.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What does a new registry value under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run typically indicate?

   • AA modification to the system's network proxy settings
   • BA change in system time zone settings
   • CA change in the default browser association
   • DA program configured to start automatically at system startup
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What does the installation of a new Windows service by a malware sample typically indicate?

   • AThe malware is communicating with a command-and-control server
   • BThe malware is cleaning up its traces from the system
   • CThe malware is trying to achieve persistence or run with elevated privileges
   • DThe malware is attempting to hide its files by changing attributes
   Reveal Solution Discussion Select an answer first