An analyst is reverse engineering a botnet client that communicates with a command-and-control server. The analyst has identified the communication protocol in the disassembly. To understand the full protocol, the analyst needs to observe the actual network traffic. Which approach is most appropriate?

Use a network sniffer on the host while running the botnet client

Run the botnet client in a controlled environment with a fake C2 server and capture the traffic

Connect the botnet client to the real C2 server and capture the traffic

Analyze the disassembly to infer the protocol without executing the sample

An analyst is reverse engineering a trojan that uses a custom encoding scheme for its configuration data. The analyst has identified the decoding routine in the disassembly. To understand the configuration, the analyst wants to extract the encoded data and apply the decoding algorithm. Which approach is most efficient?

Run the malware and observe the configuration in memory

Search the internet for the malware's configuration format

Use a hex editor to manually decode the data

Reimplement the decoding algorithm in a script and run it against the extracted data

Which statement best describes the primary purpose of reverse engineering malware?

To recover the original source code of the malware from its compiled binary.

To identify the malware's functionality and behavior to support detection, containment, and eradication.

To create a signature that matches the malware's exact byte sequence.

To determine the identity of the malware author.

A malware analyst is examining a packed binary. The entry point appears to be a small stub that decompresses the original code in memory. To analyze the unpacked code, the analyst plans to dump the process memory after the stub runs. Which technique is most appropriate?

Run the binary under a debugger, let the stub execute, then dump the memory region where the unpacked code resides

Use a static disassembler to follow the stub's control flow and reconstruct the original code without execution

Patch the binary to skip the stub and directly execute the compressed data

Run the binary in a sandbox and capture the network traffic to infer the unpacked behavior

An analyst is analyzing a malware sample that is obfuscated with a custom packer. The analyst wants to unpack the binary to analyze the original code. Which approach is most likely to succeed?

Run the binary in a debugger and dump the process memory after the unpacking stub executes

Disassemble the binary and manually reconstruct the original code from the stub

Use a generic unpacker like UPX to decompress the binary

Use a PE editor to modify the entry point to point to the original code

GIAC Reverse Engineering Malware

Domain 2Objective 1

Core Reverse Engineering Concepts GREM Practice Questions (Page 3)

Part of the Core Reverse Engineering Concepts domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 15 practice questions to prepare you well beyond it. (estimate)

15questions here

3free pages

1concept

Questions 11–15

11application · medium
An analyst is reverse engineering a botnet client that communicates with a command-and-control server. The analyst has identified the communication protocol in the disassembly. To understand the full protocol, the analyst needs to observe the actual network traffic. Which approach is most appropriate?
Select an answer first
12application · medium
An analyst is reverse engineering a trojan that uses a custom encoding scheme for its configuration data. The analyst has identified the decoding routine in the disassembly. To understand the configuration, the analyst wants to extract the encoded data and apply the decoding algorithm. Which approach is most efficient?
Select an answer first
13foundation · easy
Which statement best describes the primary purpose of reverse engineering malware?
Select an answer first
14application · medium
A malware analyst is examining a packed binary. The entry point appears to be a small stub that decompresses the original code in memory. To analyze the unpacked code, the analyst plans to dump the process memory after the stub runs. Which technique is most appropriate?
Select an answer first
15application · medium
An analyst is analyzing a malware sample that is obfuscated with a custom packer. The analyst wants to unpack the binary to analyze the original code. Which approach is most likely to succeed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Core Reverse Engineering Concepts GREM Practice Questions (Page 3)

Questions 11–15

Which statement best describes the primary purpose of reverse engineering malware?

A malware analyst is examining a packed binary. The entry point appears to be a small stub that decompresses the original code in memory. To analyze the unpacked code, the analyst plans to dump the process memory after the stub runs. Which technique is most appropriate?

An analyst is analyzing a malware sample that is obfuscated with a custom packer. The analyst wants to unpack the binary to analyze the original code. Which approach is most likely to succeed?

Keep studying — Core Reverse Engineering Concepts