What is a key difference between static and dynamic behavioral analysis?

Static analysis examines the binary without executing it, while dynamic analysis observes behavior during execution

Static analysis is always safer than dynamic analysis because it uses a virtual machine

Static analysis requires a debugger, while dynamic analysis uses only a disassembler

Static analysis observes malware in a sandbox, while dynamic analysis examines the binary without executing it

In malware analysis, what is the primary focus of behavioral analysis?

Observing the malware's actions and interactions with the system and network

Disassembling the malware to identify its compiler and packer

Comparing the malware's hash to known malware signatures

Examining the malware's source code to understand its logic

Which file system change is most indicative of a persistence mechanism in malware?

Creating a temporary file in the system temp directory

Reading a configuration file from the application directory

Modifying a file in the Windows Startup folder

Deleting a log file from the system

During dynamic analysis, an analyst observes that a process named 'rundll32.exe' is launched by a Word document and then creates a child process named 'powershell.exe'. Which behavior is most indicative of a malicious macro?

The Word document makes a DNS query to a legitimate domain.

The Word document launches rundll32.exe, which then launches powershell.exe.

The Word document creates a file in the %TEMP% directory.

The Word document opens a network connection to a local IP address.

GIAC Reverse Engineering Malware

Domain 1Objective 2

Behavioral Analysis Fundamentals GREM Practice Questions (Page 6)

Part of the Malware Analysis Fundamentals domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

10concepts

Questions 26–30

26foundation · easy
Which tool is best suited for capturing and analyzing network traffic generated by malware?
Select an answer first
27foundation · easy
What is a key difference between static and dynamic behavioral analysis?
Select an answer first
28foundation · easy
In malware analysis, what is the primary focus of behavioral analysis?
Select an answer first
29foundation · easy
Which file system change is most indicative of a persistence mechanism in malware?
Select an answer first
30application · medium
During dynamic analysis, an analyst observes that a process named 'rundll32.exe' is launched by a Word document and then creates a child process named 'powershell.exe'. Which behavior is most indicative of a malicious macro?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.