An analyst is analyzing a piece of ransomware that encrypts files and displays a ransom note. The analyst needs to identify the encryption algorithm and key management to determine if decryption is possible. Which reverse engineering approach would be most effective?

Perform dynamic analysis with a debugger to intercept cryptographic API calls and inspect key material

Run the ransomware in a sandbox and examine the encrypted files for patterns

Submit the ransomware to an online analysis service and read the report

Use static analysis to search for constant strings like 'AES' or 'RSA' in the binary

A malware analyst is reverse engineering a binary that uses a custom protocol for C2 communication. The analyst has identified the encryption algorithm used to protect the traffic. What is the next step to fully understand the protocol?

Reimplement the entire protocol in a script to simulate the malware

Search the binary for the encryption key in plaintext

Decrypt the captured network traffic using the identified algorithm and key

Use a network sniffer to capture more traffic from the malware

A security analyst receives a suspicious executable from a phishing campaign. The analyst needs to determine whether the binary is packed and identify the packer before attempting static analysis. Which approach best achieves this?

Compare the file's hash against VirusTotal to see if it is flagged as packed

Inspect the PE headers and section entropy using a tool like PEiD or Detect It Easy

Immediately disassemble the binary with IDA Pro and read the entry point instructions

Run the executable in a sandbox and capture its network traffic

An analyst receives a suspicious executable that is believed to be a downloader. The analyst needs to quickly determine whether the binary contains embedded URLs or strings that indicate command-and-control endpoints, without executing the sample. Which approach is most appropriate for this initial triage?

Submit the hash to an online multi-engine scanner and wait for the report

Disassemble the binary with a debugger and set breakpoints on network API calls

Run the binary in a sandbox and capture network traffic

Use a strings utility to extract printable character sequences and review them for URLs or IP addresses

An analyst is analyzing a malware sample that is packed and uses anti-debugging. The analyst wants to unpack the sample and analyze the payload. Which approach is most efficient?

Use a static unpacker tool that claims to handle unknown packers

Disassemble the binary and manually reconstruct the original code

Use a debugger with anti-anti-debug plugins like ScyllaHide and then dump memory after the unpacking stub

Run the sample in a sandbox and capture the network traffic

GIAC Reverse Engineering Malware

Domain 2Objective 1

Core Reverse Engineering Concepts GREM Practice Questions (Page 2)

Part of the Core Reverse Engineering Concepts domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 15 practice questions to prepare you well beyond it. (estimate)

15questions here

3free pages

1concept

Questions 6–10

6application · medium
An analyst is analyzing a piece of ransomware that encrypts files and displays a ransom note. The analyst needs to identify the encryption algorithm and key management to determine if decryption is possible. Which reverse engineering approach would be most effective?
Select an answer first
7application · medium
A malware analyst is reverse engineering a binary that uses a custom protocol for C2 communication. The analyst has identified the encryption algorithm used to protect the traffic. What is the next step to fully understand the protocol?
Select an answer first
8application · medium
A security analyst receives a suspicious executable from a phishing campaign. The analyst needs to determine whether the binary is packed and identify the packer before attempting static analysis. Which approach best achieves this?
Select an answer first
9application · medium
An analyst receives a suspicious executable that is believed to be a downloader. The analyst needs to quickly determine whether the binary contains embedded URLs or strings that indicate command-and-control endpoints, without executing the sample. Which approach is most appropriate for this initial triage?
Select an answer first
10application · medium
An analyst is analyzing a malware sample that is packed and uses anti-debugging. The analyst wants to unpack the sample and analyze the payload. Which approach is most efficient?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.