When configuring a dynamic analysis sandbox to handle malware that checks for VM artifacts, which setting is most likely to help bypass those checks?

Use a different operating system in the sandbox

Hide or remove VM-specific artifacts such as VMware tools

Increase the sandbox's network speed

Disable the sandbox's internet access

Which of the following is a common technique used to defeat obfuscation in malware?

Using a firewall to block the malware's network traffic

Deleting the obfuscation layer from the binary

Dynamic analysis to observe the malware's behavior after deobfuscation

Static analysis of the obfuscated code without execution

While statically analyzing a malware binary in IDA Pro, you encounter a function that appears to contain a large block of code that is never executed because a preceding conditional jump always takes the same path. The code block contains many instructions that do not affect the program's logic. What is the best way to handle this during analysis?

Use the 'Analyze all code' option in IDA to force disassembly of the entire block.

Identify the opaque predicate and patch the conditional jump to make the dead code reachable, then analyze it.

Skip the block entirely and focus on the main execution path.

Manually mark the unreachable block as data and continue analyzing the reachable code.

When performing static analysis on a malware sample that uses string encryption, which technique is most effective for extracting meaningful strings?

Using a disassembler to follow the decryption routine and manually decrypt the strings

Running the malware in a debugger to decrypt strings at runtime

Deleting the encryption routine from the binary

Searching for ASCII strings in the binary

A malware sample uses the NtQueryInformationProcess API with ProcessDebugPort to detect if it is being debugged. You are using x64dbg to analyze it. Which method is most effective to bypass this specific check?

Patch the call to NtQueryInformationProcess to return STATUS_SUCCESS always.

Set a breakpoint on NtQueryInformationProcess and change the return value to 0 when ProcessDebugPort is queried.

Use the ScyllaHide plugin to hide the debugger from NtQueryInformationProcess.

Run the sample without a debugger and use API monitoring to capture its behavior.

GIAC Reverse Engineering Malware

Domain 5Objective 3

Identifying and Bypassing Anti-Analysis Techniques GREM Practice Questions (Page 2)

Part of the Advanced Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

7concepts

Questions 6–10

6foundation · easy
When configuring a dynamic analysis sandbox to handle malware that checks for VM artifacts, which setting is most likely to help bypass those checks?
Select an answer first
7foundation · easy
Which of the following is a common technique used to defeat obfuscation in malware?
Select an answer first
8application · medium
While statically analyzing a malware binary in IDA Pro, you encounter a function that appears to contain a large block of code that is never executed because a preceding conditional jump always takes the same path. The code block contains many instructions that do not affect the program's logic. What is the best way to handle this during analysis?
Select an answer first
9foundation · easy
When performing static analysis on a malware sample that uses string encryption, which technique is most effective for extracting meaningful strings?
Select an answer first
10application · medium
A malware sample uses the NtQueryInformationProcess API with ProcessDebugPort to detect if it is being debugged. You are using x64dbg to analyze it. Which method is most effective to bypass this specific check?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.