GIAC Certification GIAC Malware Analyst 2

Question 1

What is the primary purpose of executing a malware sample in a sandbox environment?

Accepted Answer

To safely observe the malware's behavioral artifacts in an isolated system

Answer

To permanently remove the malware from the infected host

Answer

To decrypt the malware's encrypted payload offline

Answer

To generate a unique signature for antivirus databases

Question 2

Which anti-analysis technique involves malware querying VM-specific registry keys or using the CPUID hypervisor bit to alter its behavior?

Accepted Answer

Virtual machine detection

Answer

Code obfuscation

Answer

API hashing

Answer

DLL side-loading

Question 3

What is the primary objective of process injection techniques used by malware?

Accepted Answer

To execute malicious code inside the address space of a legitimate, trusted process

Answer

To create a new Windows service for long-term persistence

Answer

To harvest stored credentials from the LSASS process memory

Answer

To modify the Master Boot Record for bootkit-level persistence

Question 4

Which dynamic analysis tool intercepts and logs Windows API calls made by a running malware sample in real time?

Accepted Answer

API Monitor

Answer

Wireshark

Answer

Volatility

Answer

YARA

Question 5

Which indicator most strongly suggests a process is a victim of process hollowing?

Accepted Answer

The in-memory image of a process does not match the binary on disk

Answer

The process has an unusually large number of open handles

Answer

The process has no child processes spawned from it

Answer

The process has a higher-than-average CPU usage

Question 6

In malware terminology, what is the primary function of a 'dropper'?

Accepted Answer

To deliver and install a secondary malicious payload onto the victim system

Answer

To encrypt victim files and demand a ransom for decryption

Answer

To propagate the infection laterally across network hosts

Answer

To intercept and exfiltrate keystrokes and clipboard data

Question 7

Why do malware authors predominantly use HTTP or HTTPS for Command and Control (C2) communications?

Accepted Answer

To blend C2 traffic with legitimate web traffic and bypass firewall rules

Answer

Because HTTP provides faster data transfer than DNS-based channels

Answer

Because HTTP traffic is encrypted end-to-end by default

Answer

Because HTTP is the only protocol permitted through all enterprise firewalls