A malware analyst is tasked with analyzing a new ransomware variant. The analyst has a sandbox that can simulate network services and a debugger. The analyst needs to identify the ransomware's encryption routine and the file extensions it targets. Which two-phase approach is most effective?

First run the sample in the sandbox with simulated services, then use the debugger to trace the encryption function

Immediately reverse the binary's code without executing it

Only use the debugger to step through the entire binary from the entry point

Only run the sample in the sandbox and review the network logs

A malware analyst is analyzing a downloader that fetches a second-stage payload. The analyst needs to identify the URL and the payload's hash. Which analysis technique is most efficient?

Use a debugger to trace the download function

Search threat intelligence for the downloader's hash

Run the downloader in a sandbox with network simulation and capture the downloaded file

Perform static analysis of the downloader's strings

A security team is analyzing a rootkit that hides its processes and files. The team needs to detect the rootkit's presence on a live system. Which analysis technique is most effective?

Compare the output of user-mode API calls with raw kernel data structures

Use a process viewer to list running processes

Run a standard antivirus scan on the system

Reboot the system and run a disk scan

An incident response team is analyzing a memory image from a compromised server. The team suspects a kernel-level rootkit. They need to confirm the rootkit's presence and identify its artifacts. The team has limited time and must choose between deep manual memory analysis and running an automated memory analysis framework. Which approach is most appropriate?

Only run an automated memory analysis framework and trust its results

Rebuild the server from a known-good image and skip analysis

Only perform manual memory analysis to avoid false positives from automated tools

Run an automated memory analysis framework to quickly scan for anomalies, then manually verify suspicious findings

A malware analyst is analyzing a sample that uses environment-aware techniques to evade sandboxes. The sample checks for the presence of analysis tools and delays execution. The analyst needs to obtain reliable behavioral data. Which approach is most effective?

Run the sample in a default sandbox and accept the results

Run the sample on a physical machine with monitoring tools

Use a custom sandbox that mimics a real user environment and disables common analysis artifacts

Patch the sample to disable the environment checks

GIAC Reverse Engineering Malware

Domain 1Objective 1

Malware Analysis Fundamentals GREM Practice Questions (Page 2)

Part of the Malware Analysis Fundamentals domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

1concept

Questions 6–10

6application · medium
A malware analyst is tasked with analyzing a new ransomware variant. The analyst has a sandbox that can simulate network services and a debugger. The analyst needs to identify the ransomware's encryption routine and the file extensions it targets. Which two-phase approach is most effective?
Select an answer first
7application · medium
A malware analyst is analyzing a downloader that fetches a second-stage payload. The analyst needs to identify the URL and the payload's hash. Which analysis technique is most efficient?
Select an answer first
8application · medium
A security team is analyzing a rootkit that hides its processes and files. The team needs to detect the rootkit's presence on a live system. Which analysis technique is most effective?
Select an answer first
9expert · hard
An incident response team is analyzing a memory image from a compromised server. The team suspects a kernel-level rootkit. They need to confirm the rootkit's presence and identify its artifacts. The team has limited time and must choose between deep manual memory analysis and running an automated memory analysis framework. Which approach is most appropriate?
Select an answer first
10expert · hard
A malware analyst is analyzing a sample that uses environment-aware techniques to evade sandboxes. The sample checks for the presence of analysis tools and delays execution. The analyst needs to obtain reliable behavioral data. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.