A network analyst observes a compromised host making periodic DNS queries to a domain that resolves to different IP addresses each time. The queries are for long, random-looking subdomains. The host also sends HTTP requests to a legitimate-looking website, but the responses contain encoded data. Which C2 pattern is most likely in use?

HTTP polling with data in the URL

IRC-based C2 with DCC file transfers

DNS tunneling with encoded data in subdomains

HTTPS C2 with certificate pinning

A security team notices that a compromised server is sending large volumes of data to a remote IP address over port 443. The data is encrypted and the destination is a cloud storage provider. Which data exfiltration pattern is most likely being used?

HTTPS POST to a cloud storage API

Email with attachments via SMTP

FTP upload to an external server

A malware sample is observed to first exploit a vulnerability to gain SYSTEM privileges, then download a second-stage payload, and finally begin exfiltrating data. Which malware lifecycle stages are these in order?

Delivery, persistence, command and control

Exploitation, installation, exfiltration

Command and control, persistence, exfiltration

Installation, exploitation, impact

A malware analyst is reverse engineering a sample that uses a custom packer. The sample appears to unpack only when it detects that it is not being debugged and not running in a VM. The analyst wants to bypass these checks to analyze the unpacked payload. Which approach would be most effective?

Use a custom environment that simulates a non-VM, non-debugged system, such as a bare-metal machine with a kernel debugger hidden

Use a debugger to set a breakpoint after the unpacking routine and dump the process memory

Patch the anti-debugging and anti-VM checks in the binary to always take the 'unpack' branch

Run the sample in a real machine without a debugger and capture the unpacked payload from memory

A malware sample writes a value to HKCU\Software\Microsoft\Windows\CurrentVersion\Run. What is the primary purpose of this action?

To disable Windows Defender by changing security settings

To escalate privileges by modifying user account settings

To hide the malware from file system enumeration

To establish persistence by executing the malware at user logon

GIAC Reverse Engineering Malware

Domain 3Objective 1

Common Malware Patterns GREM Practice Questions (Page 4)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 16–20

16application · medium
A network analyst observes a compromised host making periodic DNS queries to a domain that resolves to different IP addresses each time. The queries are for long, random-looking subdomains. The host also sends HTTP requests to a legitimate-looking website, but the responses contain encoded data. Which C2 pattern is most likely in use?
Select an answer first
17application · medium
A security team notices that a compromised server is sending large volumes of data to a remote IP address over port 443. The data is encrypted and the destination is a cloud storage provider. Which data exfiltration pattern is most likely being used?
Select an answer first
18application · medium
A malware sample is observed to first exploit a vulnerability to gain SYSTEM privileges, then download a second-stage payload, and finally begin exfiltrating data. Which malware lifecycle stages are these in order?
Select an answer first
19expert · hard
A malware analyst is reverse engineering a sample that uses a custom packer. The sample appears to unpack only when it detects that it is not being debugged and not running in a VM. The analyst wants to bypass these checks to analyze the unpacked payload. Which approach would be most effective?
Select an answer first
20foundation · easy
A malware sample writes a value to HKCU\Software\Microsoft\Windows\CurrentVersion\Run. What is the primary purpose of this action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.