A company is deploying a new endpoint protection solution. They need to block known malware signatures, prevent memory corruption exploits, and allow only approved applications to run. Which combination of controls best meets these requirements?

Application whitelisting, sandboxing, and antivirus

Host-based intrusion prevention, ASLR, and sandboxing

Antivirus, DEP, and application whitelisting

Antivirus, stack canaries, and host-based intrusion prevention

A security analyst is reviewing a memory corruption exploit that attempts to overwrite a return address on the stack. The organization has enabled ASLR and DEP on all endpoints. Which additional mitigation would most directly prevent this specific attack?

Host-based intrusion prevention

A malware analyst has a suspected ransomware sample. The analyst needs to determine the encryption algorithm used and identify the command-and-control server. The sample is known to be destructive if executed. Which analysis approach is most appropriate?

Static analysis to examine the binary for encryption routines and embedded URLs

Memory analysis after executing the sample

Dynamic analysis in a sandbox to observe encryption behavior

Network analysis by running the sample and capturing traffic

GIAC Security Essentials

Domain 5Objective 3

Malicious Code & Exploit Mitigation GSEC Practice Questions (Page 9)

Part of the Security Operations and Incident Response domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 41–44

41foundation · easy
A user receives an email with an attachment that, when opened, executes a macro that downloads additional malware. Which infection vector is being used?
Select an answer first
42expert · hard
A company is deploying a new endpoint protection solution. They need to block known malware signatures, prevent memory corruption exploits, and allow only approved applications to run. Which combination of controls best meets these requirements?
Select an answer first
43application · medium
A security analyst is reviewing a memory corruption exploit that attempts to overwrite a return address on the stack. The organization has enabled ASLR and DEP on all endpoints. Which additional mitigation would most directly prevent this specific attack?
Select an answer first
44expert · hard
A malware analyst has a suspected ransomware sample. The analyst needs to determine the encryption algorithm used and identify the command-and-control server. The sample is known to be destructive if executed. Which analysis approach is most appropriate?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.

Malicious Code & Exploit Mitigation GSEC Practice Questions (Page 9)

Questions 41–44

A user receives an email with an attachment that, when opened, executes a macro that downloads additional malware. Which infection vector is being used?

A company is deploying a new endpoint protection solution. They need to block known malware signatures, prevent memory corruption exploits, and allow only approved applications to run. Which combination of controls best meets these requirements?

A security analyst is reviewing a memory corruption exploit that attempts to overwrite a return address on the stack. The organization has enabled ASLR and DEP on all endpoints. Which additional mitigation would most directly prevent this specific attack?

A malware analyst has a suspected ransomware sample. The analyst needs to determine the encryption algorithm used and identify the command-and-control server. The sample is known to be destructive if executed. Which analysis approach is most appropriate?

Keep studying — Security Operations and Incident Response