A security team is investigating a malware outbreak where the malware escalates privileges by exploiting a vulnerability in a local service. The team wants to detect this activity without relying on signature-based detection. Which detection approach would be most effective?

Monitor for network connections to known malicious IP addresses

Monitor for unusual parent-child process relationships, such as a word processor spawning a command shell

Monitor for changes to critical registry keys and file system locations

Monitor for abnormal token privileges or integrity levels in processes

A malware analyst is examining a sample that, when run under a debugger, exits immediately. When run normally, it executes its payload. The sample also checks the number of CPU cores and the presence of a specific registry key. Which defense evasion technique is the sample primarily using?

Anti-debugging via timing checks

Anti-debugging via debugger detection

Anti-VM via hardware resource checks

A security analyst is investigating a Windows workstation that repeatedly re-infects after remediation. The malware appears to survive reboots and user logoffs. Which persistence mechanism should the analyst check FIRST to confirm the most common malware persistence pattern?

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Startup folder in the user's AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Scheduled task that runs at system startup

Windows service registered with the Service Control Manager

GIAC Reverse Engineering Malware

Domain 3Objective 1

Common Malware Patterns GREM Practice Questions (Page 2)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 6–10

6foundation · easy
In the typical malware lifecycle, which stage occurs immediately after initial infection?
Select an answer first
7expert · hard
A security team is investigating a malware outbreak where the malware escalates privileges by exploiting a vulnerability in a local service. The team wants to detect this activity without relying on signature-based detection. Which detection approach would be most effective?
Select an answer first
8application · medium
A malware analyst is examining a sample that, when run under a debugger, exits immediately. When run normally, it executes its payload. The sample also checks the number of CPU cores and the presence of a specific registry key. Which defense evasion technique is the sample primarily using?
Select an answer first
9application · medium
A security analyst is investigating a Windows workstation that repeatedly re-infects after remediation. The malware appears to survive reboots and user logoffs. Which persistence mechanism should the analyst check FIRST to confirm the most common malware persistence pattern?
Select an answer first
10foundation · easy
A malware sample periodically sends HTTP GET requests to a hardcoded domain and receives commands in the response body. Which C2 communication pattern does this describe?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Common Malware Patterns GREM Practice Questions (Page 2)

Questions 6–10

In the typical malware lifecycle, which stage occurs immediately after initial infection?

A security team is investigating a malware outbreak where the malware escalates privileges by exploiting a vulnerability in a local service. The team wants to detect this activity without relying on signature-based detection. Which detection approach would be most effective?

A malware analyst is examining a sample that, when run under a debugger, exits immediately. When run normally, it executes its payload. The sample also checks the number of CPU cores and the presence of a specific registry key. Which defense evasion technique is the sample primarily using?

A security analyst is investigating a Windows workstation that repeatedly re-infects after remediation. The malware appears to survive reboots and user logoffs. Which persistence mechanism should the analyst check FIRST to confirm the most common malware persistence pattern?

A malware sample periodically sends HTTP GET requests to a hardcoded domain and receives commands in the response body. Which C2 communication pattern does this describe?

Keep studying — Malware Patterns and Obfuscation