An analyst is examining a PE file with a suspicious entry point that points to the middle of the `.data` section. The import table is sparse, containing only `LoadLibraryA` and `GetProcAddress`. The section `.data` is marked as executable. What is the most likely explanation?

The binary is a legitimate program that uses runtime code generation in the `.data` section.

The binary is packed, and the entry point in `.data` is part of the unpacking stub that will decrypt the original code.

The binary is a .NET assembly, and the entry point in `.data` is the managed entry point.

The binary is a DLL that exports functions from the `.data` section.

Which of the following is a common static indicator of a packed executable?

A large number of readable strings

A very small import table with only a few functions like LoadLibrary and GetProcAddress

A single section named .text with normal entropy

A compilation timestamp in the future

An analyst is examining a PE file and notices that the SizeOfImage field in the optional header is significantly larger than the sum of all section sizes. The entry point is in the last section, which has a virtual size much larger than its raw size. What does this indicate?

The file is packed, and the last section will expand in memory to hold the unpacked code.

The file has a corrupted PE header that should be repaired.

The file is a driver that maps large kernel memory regions.

The file is a resource-only DLL with large embedded resources.

An analyst runs strings on a malware sample and finds a large number of readable strings, including URLs, file paths, and registry keys. However, the sample's .text section has an entropy of 7.8. The import table is normal and contains typical Windows APIs. What is the most likely explanation for this combination?

The strings are false positives from the strings tool.

The sample is not packed, and the high entropy is due to encryption or compression of a specific code section.

The sample is packed, and the strings are from the unpacking stub.

The sample is a legitimate program that happens to have high entropy in its code section.

What does high entropy in a PE section typically indicate?

The section is part of the resource directory

The section contains compressed or encrypted data

The section contains mostly zeros

The section contains plaintext strings

GIAC Reverse Engineering Malware

Domain 1Objective 3

Static Analysis Fundamentals GREM Practice Questions (Page 2)

Part of the Malware Analysis Fundamentals domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

11concepts

Questions 6–10

6expert · hard
An analyst is examining a PE file with a suspicious entry point that points to the middle of the `.data` section. The import table is sparse, containing only `LoadLibraryA` and `GetProcAddress`. The section `.data` is marked as executable. What is the most likely explanation?
Select an answer first
7foundation · easy
Which of the following is a common static indicator of a packed executable?
Select an answer first
8application · medium
An analyst is examining a PE file and notices that the SizeOfImage field in the optional header is significantly larger than the sum of all section sizes. The entry point is in the last section, which has a virtual size much larger than its raw size. What does this indicate?
Select an answer first
9expert · hard
An analyst runs strings on a malware sample and finds a large number of readable strings, including URLs, file paths, and registry keys. However, the sample's .text section has an entropy of 7.8. The import table is normal and contains typical Windows APIs. What is the most likely explanation for this combination?
Select an answer first
10foundation · easy
What does high entropy in a PE section typically indicate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.