A security analyst at a mid-sized company receives an alert from the EDR about a suspicious PowerShell command that downloaded a binary from a file-sharing site. The analyst needs to determine whether the binary is malicious and what it does, but the endpoint is still in production and cannot be taken offline. Which approach best aligns with the goals of malware analysis in this incident-response context?

Copy the binary to a sandbox and perform static analysis first, then dynamic analysis if needed.

Immediately execute the binary on the analyst's workstation to observe its behavior.

Run the binary in a VM without network isolation to capture real C2 traffic.

Delete the binary from the endpoint and rely on the EDR alert details for the report.

A malware analyst is analyzing a trojan that is known to download additional payloads. The analyst wants to identify the command-and-control (C2) server addresses. Which analysis technique would be most effective for this purpose?

Perform dynamic analysis in a controlled environment and monitor network traffic.

Check the file's digital signature to identify the author.

Disassemble the binary and look for the 'connect' API call.

Use a hex editor to search for IP addresses in the binary.

A security team is investigating a malware infection that is spreading through a network share. The team needs to identify the malware's propagation method to contain the spread. Which analysis technique would provide the most direct evidence?

Use static analysis to look for strings like 'copy' or 'net share' in the binary.

Perform dynamic analysis and monitor file system and network activity for attempts to copy itself or create network shares.

Check the malware's digital signature to see if it is a known worm.

Review the network logs to see which IPs the infected host communicated with.

During an incident response, an analyst finds a suspicious executable on a server. The analyst needs to determine if the executable is malware and what it does, but the server is critical and cannot be taken offline. Which action is most appropriate?

Copy the executable to an isolated analysis VM and perform static and dynamic analysis there.

Run the executable on the server in a sandboxed user account to observe its behavior.

Use a live CD to boot the server and analyze the executable from the CD environment.

Delete the executable and restore the server from a known-good backup.

A malware analyst is examining a suspicious PDF file that is believed to exploit a vulnerability in a PDF reader. The analyst needs to determine the exploit's payload. Which analysis approach is most appropriate?

Use a PDF analysis tool to inspect the file's objects and JavaScript, and extract any embedded executable.

Open the PDF in a vulnerable PDF reader on an isolated VM to trigger the exploit.

Convert the PDF to an image and view it to see if it contains malicious content.

Submit the PDF to an online virus scanner and rely on the detection result.

GIAC Reverse Engineering Malware

Domain 1Objective 1

Malware Analysis Fundamentals GREM Practice Questions (Page 5)

Part of the Malware Analysis Fundamentals domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

1concept

Questions 21–25

21application · medium
A security analyst at a mid-sized company receives an alert from the EDR about a suspicious PowerShell command that downloaded a binary from a file-sharing site. The analyst needs to determine whether the binary is malicious and what it does, but the endpoint is still in production and cannot be taken offline. Which approach best aligns with the goals of malware analysis in this incident-response context?
Select an answer first
22application · medium
A malware analyst is analyzing a trojan that is known to download additional payloads. The analyst wants to identify the command-and-control (C2) server addresses. Which analysis technique would be most effective for this purpose?
Select an answer first
23application · medium
A security team is investigating a malware infection that is spreading through a network share. The team needs to identify the malware's propagation method to contain the spread. Which analysis technique would provide the most direct evidence?
Select an answer first
24application · medium
During an incident response, an analyst finds a suspicious executable on a server. The analyst needs to determine if the executable is malware and what it does, but the server is critical and cannot be taken offline. Which action is most appropriate?
Select an answer first
25application · medium
A malware analyst is examining a suspicious PDF file that is believed to exploit a vulnerability in a PDF reader. The analyst needs to determine the exploit's payload. Which analysis approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.