A security analyst is analyzing a piece of malware that is suspected of stealing credentials from a web browser. The analyst wants to identify the specific APIs the malware uses to access browser data. Which static analysis technique would be most useful?

Check the file's version information to see if it is a known browser plugin.

Run the malware in a debugger and set breakpoints on all API calls.

Use a network sniffer to capture any data sent over the network.

Examine the import table of the executable to see which Windows API functions are imported.

A security team is analyzing a keylogger that captures keystrokes and sends them to a remote server. The team needs to identify the keystroke logging mechanism and the exfiltration destination. Which combination of techniques is most effective?

Only perform static analysis of the binary's imports

Use a debugger to step through the entire binary

Run the keylogger in a sandbox, monitor API calls related to keyboard input, and capture network traffic

Only run the keylogger in a sandbox and observe file system changes

A security team is analyzing a document with a macro that downloads a payload. The team wants to extract the macro and the URL it contacts without executing the document. Which approach is most appropriate?

Disassemble the document's binary code

Run the document in a sandbox and capture network traffic

Use a tool to extract the macro code from the document's OLE streams

Open the document in a word processor with macros disabled and inspect the macro source

Which statement best describes the primary goal of malware analysis in the context of incident response?

To attribute the attack to a specific threat actor with absolute certainty

To identify the malware's capabilities and indicators of compromise to support containment and eradication

To delete the malware from infected systems as quickly as possible

To reverse-engineer every sample to its original source code for legal prosecution

A malware analyst is analyzing a sample that is known to use anti-debugging techniques. The analyst needs to bypass these techniques to analyze the malware's behavior. Which approach is most effective?

Run the malware without a debugger and rely on static analysis only.

Patch the malware's anti-debugging checks in the binary before running it.

Use a debugger plugin or script that hides the debugger's presence from the malware.

Run the malware in a VM without any debugging tools.

GIAC Reverse Engineering Malware

Domain 1Objective 1

Malware Analysis Fundamentals GREM Practice Questions (Page 3)

Part of the Malware Analysis Fundamentals domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

1concept

Questions 11–15

11application · medium
A security analyst is analyzing a piece of malware that is suspected of stealing credentials from a web browser. The analyst wants to identify the specific APIs the malware uses to access browser data. Which static analysis technique would be most useful?
Select an answer first
12application · medium
A security team is analyzing a keylogger that captures keystrokes and sends them to a remote server. The team needs to identify the keystroke logging mechanism and the exfiltration destination. Which combination of techniques is most effective?
Select an answer first
13application · medium
A security team is analyzing a document with a macro that downloads a payload. The team wants to extract the macro and the URL it contacts without executing the document. Which approach is most appropriate?
Select an answer first
14foundation · easy
Which statement best describes the primary goal of malware analysis in the context of incident response?
Select an answer first
15application · medium
A malware analyst is analyzing a sample that is known to use anti-debugging techniques. The analyst needs to bypass these techniques to analyze the malware's behavior. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.