A security operations center (SOC) is investigating a compromised host that is using DNS tunneling for C2. The SOC wants to block the C2 traffic without disrupting legitimate DNS services. Which approach would be most effective?

Disable recursive DNS resolution on the internal DNS servers

Implement DNS sinkholing for known malicious domains

Deploy a DNS firewall that inspects DNS queries for tunneling patterns

Block all DNS queries to external domains

An incident responder finds that an attacker moved from one workstation to a server by using a stolen NTLM hash to authenticate and then created a scheduled task on the server to execute a payload. Which lateral movement pattern is this?

Pass-the-ticket followed by remote service execution

Windows Management Instrumentation (WMI) remote execution

Pass-the-hash followed by remote scheduled task execution

Remote desktop protocol (RDP) with saved credentials

An incident response team is responding to a ransomware attack that spread laterally using pass-the-hash and scheduled tasks. The team wants to contain the spread while preserving forensic evidence. Which action should they take FIRST?

Run a full antivirus scan on all affected systems

Reset the passwords of all compromised accounts and disable the scheduled tasks

Isolate the compromised hosts from the network while preserving memory and disk images

Notify law enforcement and wait for instructions

A malware analyst is analyzing a sample that uses a scheduled task for persistence. The scheduled task runs a PowerShell script that downloads and executes a payload. The analyst also finds that the sample uses a UAC bypass to run with elevated privileges. Which combination of persistence and privilege escalation techniques is the sample using?

Scheduled task for persistence and UAC bypass for privilege escalation

Windows service for persistence and vulnerability exploitation for privilege escalation

Startup folder for persistence and DLL hijacking for privilege escalation

Registry Run key for persistence and token manipulation for privilege escalation

During a forensic review, an analyst finds that a low-privileged process successfully created a new local administrator account. The process did not exploit any known vulnerability. Which privilege escalation pattern most likely explains this?

The process used a service misconfiguration to start a new service as SYSTEM

The process exploited a kernel vulnerability to gain ring-0 access

The process used a DLL search-order hijack to run as SYSTEM

The process inherited a high-integrity token from its parent process

GIAC Reverse Engineering Malware

Domain 3Objective 1

Common Malware Patterns GREM Practice Questions (Page 3)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 11–15

11expert · hard
A security operations center (SOC) is investigating a compromised host that is using DNS tunneling for C2. The SOC wants to block the C2 traffic without disrupting legitimate DNS services. Which approach would be most effective?
Select an answer first
12application · medium
An incident responder finds that an attacker moved from one workstation to a server by using a stolen NTLM hash to authenticate and then created a scheduled task on the server to execute a payload. Which lateral movement pattern is this?
Select an answer first
13expert · hard
An incident response team is responding to a ransomware attack that spread laterally using pass-the-hash and scheduled tasks. The team wants to contain the spread while preserving forensic evidence. Which action should they take FIRST?
Select an answer first
14expert · hard
A malware analyst is analyzing a sample that uses a scheduled task for persistence. The scheduled task runs a PowerShell script that downloads and executes a payload. The analyst also finds that the sample uses a UAC bypass to run with elevated privileges. Which combination of persistence and privilege escalation techniques is the sample using?
Select an answer first
15application · medium
During a forensic review, an analyst finds that a low-privileged process successfully created a new local administrator account. The process did not exploit any known vulnerability. Which privilege escalation pattern most likely explains this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.