What does an unexpected DNS query to a domain that does not resolve to a known service suggest?

The malware is performing a DNS rebinding attack

The malware is updating its virus definitions

The malware is attempting to contact a command-and-control server

The malware is checking for internet connectivity

A security analyst needs to observe the behavior of a suspected trojan downloader in an isolated VM. The analyst must capture the initial DNS query and subsequent HTTP request to the C2 domain, but the corporate policy requires that no traffic leave the analysis lab. Which configuration should the analyst use?

Connect the VM to a virtual switch with a host-only adapter and run Wireshark on the host to capture traffic.

Disable the VM's network adapter and use a packet capture file from a previous infection.

Attach the VM to the corporate network and rely on the firewall to block outbound connections.

Use NAT networking and configure the host's firewall to block all outbound traffic from the VM.

Which registry key modification is commonly used by malware to achieve persistence?

HKEY_CURRENT_USER\Control Panel\Colors

HKEY_LOCAL_MACHINE\Hardware\DeviceMap\Keyboard

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\Software\Classes\.txt

An analyst submits a sample to an automated sandbox. The report shows that the sample creates a service named 'LegitService' with a binary path of 'C:\ProgramData\svc.exe', and then the service makes an HTTP request to a domain that is 24 hours old. Which finding is most suspicious?

The binary path is 'C:\ProgramData\svc.exe'.

The service makes an HTTP request to a domain that is 24 hours old.

The service is named 'LegitService'.

The service is created with a display name that matches the binary name.

What is a primary advantage of using an automated sandbox for malware analysis?

It can quickly generate a behavioral report without manual interaction

It guarantees the malware will be fully unpacked and deobfuscated

It eliminates the need for manual analysis entirely

It allows the malware to run on the host system for more realistic behavior

GIAC Reverse Engineering Malware

Domain 1Objective 2

Behavioral Analysis Fundamentals GREM Practice Questions (Page 7)

Part of the Malware Analysis Fundamentals domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

10concepts

Questions 31–35

31foundation · easy
What does an unexpected DNS query to a domain that does not resolve to a known service suggest?
Select an answer first
32application · medium
A security analyst needs to observe the behavior of a suspected trojan downloader in an isolated VM. The analyst must capture the initial DNS query and subsequent HTTP request to the C2 domain, but the corporate policy requires that no traffic leave the analysis lab. Which configuration should the analyst use?
Select an answer first
33foundation · easy
Which registry key modification is commonly used by malware to achieve persistence?
Select an answer first
34application · medium
An analyst submits a sample to an automated sandbox. The report shows that the sample creates a service named 'LegitService' with a binary path of 'C:\ProgramData\svc.exe', and then the service makes an HTTP request to a domain that is 24 hours old. Which finding is most suspicious?
Select an answer first
35foundation · easy
What is a primary advantage of using an automated sandbox for malware analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.