An analyst is setting up a VM to analyze a sample that is known to check for the presence of analysis tools. The analyst wants to minimize the chance that the malware detects the analysis environment. Which configuration is most effective?

Use a bare-metal machine with no analysis tools installed, and capture traffic with an external tap.

Use a VM with default settings and install the tools after the malware has executed.

Install the analysis tools in the VM and run them from a network share.

Use a VM with a bridged network adapter and no host-only adapter.

A malware analyst needs to analyze a sample that is known to use a custom protocol over UDP for C2 communication. The analyst wants to capture the traffic and also prevent the malware from communicating with the real C2 server. The analyst has access to a VM with a virtual network. Which approach is most effective?

Use a fake UDP server on the host that listens on the same port and responds to the malware, while capturing all traffic.

Use Wireshark on the VM to capture traffic and configure the VM's firewall to block all UDP traffic.

Use a DNS sinkhole to redirect the C2 domain to a local IP and capture traffic on the VM.

Use a network tap on the host to capture all traffic and block the VM's internet access via the firewall.

Which networking control is commonly used in a malware analysis sandbox to safely observe network behavior?

Disabling all network interfaces to prevent any communication

Using a bridged network with no firewall to allow all traffic

Connecting the VM directly to the internet to observe real command-and-control traffic

Using a host-only network with a virtual DNS and HTTP proxy to log traffic

What is the purpose of correlating observed behaviors with potential malicious intent in a behavioral analysis report?

To help the reader understand why the behaviors are significant

To hide the less important findings

To make the report longer and more detailed

To ensure the report is written in a technical language only

Which process activity is a strong indicator of code injection?

A process opening a handle to another process and allocating memory in it

A process creating a new thread in its own address space

A process terminating normally after completing its task

A process reading its own configuration file

GIAC Reverse Engineering Malware

Domain 1Objective 2

Behavioral Analysis Fundamentals GREM Practice Questions (Page 5)

Part of the Malware Analysis Fundamentals domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

10concepts

Questions 21–25

21application · medium
An analyst is setting up a VM to analyze a sample that is known to check for the presence of analysis tools. The analyst wants to minimize the chance that the malware detects the analysis environment. Which configuration is most effective?
Select an answer first
22expert · hard
A malware analyst needs to analyze a sample that is known to use a custom protocol over UDP for C2 communication. The analyst wants to capture the traffic and also prevent the malware from communicating with the real C2 server. The analyst has access to a VM with a virtual network. Which approach is most effective?
Select an answer first
23foundation · easy
Which networking control is commonly used in a malware analysis sandbox to safely observe network behavior?
Select an answer first
24foundation · easy
What is the purpose of correlating observed behaviors with potential malicious intent in a behavioral analysis report?
Select an answer first
25foundation · easy
Which process activity is a strong indicator of code injection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.