A malware analyst is analyzing a sample that uses a rootkit to hide its presence. The analyst wants to identify the rootkit's kernel-mode components. Which approach is most effective?

Use a rootkit scanner like GMER to detect hidden processes and files

Use a kernel debugger to inspect loaded kernel modules and hooks

Analyze the binary statically to find kernel-mode drivers

Run the sample in user-mode and use API Monitor to log calls

During analysis of a Windows executable, an analyst notices that the import table contains only a few functions such as LoadLibraryA and GetProcAddress. The rest of the API calls appear to be resolved at runtime. What does this observation suggest about the malware's behavior?

The malware is packed and the import table will be restored after unpacking

The malware is likely using dynamic API resolution to evade static import analysis

The malware is a benign program that only uses system services

The malware is probably written in a high-level language that does not use imports

Which methodology is commonly used as a first step in reverse engineering an unknown malware sample?

Debugging the malware with a kernel debugger.

Static analysis of the binary without executing it.

Dynamic analysis in a sandbox to observe runtime behavior.

Memory forensics of the infected host.

A security team has captured a malicious document that drops a binary when opened. The team wants to analyze the binary without triggering the document's exploit. Which approach is most appropriate?

Extract the embedded binary from the document using a tool like 7-Zip or olevba, then analyze it statically

Run the document through an online sandbox and capture the dropped binary

Disassemble the document's macro code to understand the exploit

Open the document in a word processor on an isolated VM to observe the dropped file

A malware analyst is reverse engineering a trojan that uses anti-debugging techniques. The analyst wants to bypass the anti-debugging checks to analyze the unpacked payload in a debugger. Which approach is most effective?

Use a debugger plugin like ScyllaHide to automatically bypass common anti-debugging tricks

Run the malware in a virtual machine with debugger detection disabled

Use a kernel-mode debugger like WinDbg to hide the debugger from user-mode checks

Patch the anti-debugging API calls to return success values

GIAC Reverse Engineering Malware

Domain 2Objective 1

Core Reverse Engineering Concepts GREM Practice Questions (Page 1)

Part of the Core Reverse Engineering Concepts domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 15 practice questions to prepare you well beyond it. (estimate)

15questions here

3free pages

1concept

Questions 1–5

1application · medium
A malware analyst is analyzing a sample that uses a rootkit to hide its presence. The analyst wants to identify the rootkit's kernel-mode components. Which approach is most effective?
Select an answer first
2application · medium
During analysis of a Windows executable, an analyst notices that the import table contains only a few functions such as LoadLibraryA and GetProcAddress. The rest of the API calls appear to be resolved at runtime. What does this observation suggest about the malware's behavior?
Select an answer first
3foundation · easy
Which methodology is commonly used as a first step in reverse engineering an unknown malware sample?
Select an answer first
4application · medium
A security team has captured a malicious document that drops a binary when opened. The team wants to analyze the binary without triggering the document's exploit. Which approach is most appropriate?
Select an answer first
5application · medium
A malware analyst is reverse engineering a trojan that uses anti-debugging techniques. The analyst wants to bypass the anti-debugging checks to analyze the unpacked payload in a debugger. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.