Which of the following is a characteristic of DNS tunneling as a C2 method?

It uses IRC channels for communication

It requires a direct TCP connection to the C2 server

It encodes data in DNS queries and responses

It uses the HTTP protocol to send commands

A malware analyst is documenting the lifecycle of a trojan that uses anti-debugging and anti-VM techniques. The trojan is delivered via a malicious document, establishes persistence via a registry Run key, and then communicates with a C2 server. The analyst needs to determine the order of the lifecycle stages. Which order is correct?

Persistence, initial infection, C2, impact

C2, initial infection, persistence, impact

Initial infection, C2, persistence, impact

Initial infection, persistence, C2, impact

Which of the following is a typical privilege escalation technique that abuses a vulnerability in a legitimate service?

Exploiting a buffer overflow in a kernel driver

GIAC Reverse Engineering Malware

Domain 3Objective 1

Common Malware Patterns GREM Practice Questions (Page 9)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 41–43

41foundation · easy
Which of the following is a characteristic of DNS tunneling as a C2 method?
Select an answer first
42expert · hard
A malware analyst is documenting the lifecycle of a trojan that uses anti-debugging and anti-VM techniques. The trojan is delivered via a malicious document, establishes persistence via a registry Run key, and then communicates with a C2 server. The analyst needs to determine the order of the lifecycle stages. Which order is correct?
Select an answer first
43foundation · easy
Which of the following is a typical privilege escalation technique that abuses a vulnerability in a legitimate service?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Common Malware Patterns GREM Practice Questions (Page 9)

Questions 41–43

Which of the following is a characteristic of DNS tunneling as a C2 method?

Which of the following is a typical privilege escalation technique that abuses a vulnerability in a legitimate service?

Keep studying — Malware Patterns and Obfuscation