GIAC GREM 問題練習

Question No : 1
What is the purpose of employing anti-disassembly techniques in malware?

• A.To create efficient code
• B.To optimize the execution speed
• C.To hinder static analysis by analysts and automated tools
• D.To improve compatibility with different system architectures

答えを確認する

正解:

Question No : 2
Which of the following indicators suggest the presence of .NET malware in a system? (Choose two)

• A.Executable files with .exe extensions
• B.Usage of mscorlib.dll
• C.Extensive use of string decryption functions
• D.Packed binary sections

答えを確認する

正解:

Question No : 3
Which assembly instruction is commonly used to alter the flow of execution in malware?

• A.MOV
• B.JMP
• C.PUSH
• D.RET

答えを確認する

正解:

Question No : 4
In reverse engineering .NET malware, what does dynamic analysis allow you to observe?

• A.The source code in its original high-level language
• B.How the application interacts with its environment in real-time
• C.The static set of APIs called by the application
• D.The file size and checksum

答えを確認する

正解:

Question No : 5
Which API calls are commonly used by malware to manipulate processes and inject code? (Choose two)

• A.VirtualAllocEx()
• B.WriteProcessMemory()
• C.SendMessage()
• D.NtQueryInformationFile()

答えを確認する

正解:

Question No : 6
Which of the following is a common obfuscation technique used in .NET malware?

• A.String encryption
• B.Packed sections
• C.Code injection
• D.Process hollowing

答えを確認する

正解:

Question No : 7
Which of the following are common flow control instructions used in malware? (Choose two)

• A.JMP
• B.XOR
• C.CALL
• D.POP

答えを確認する

正解:

Question No : 8
You are analyzing a malware sample that appears to inject malicious code into the explorer.exe process. During execution, the malware creates a remote thread in explorer.exe and uses API calls to manipulate its memory.
How would you proceed with the analysis? (Choose three)

• A.Monitor the API calls used for process injection, such as VirtualAllocEx() and CreateRemoteThread().
• B.Dump the memory of the explorer.exe process and search for injected code.
• C.Use a tool like Procmon to observe filesystem activity.
• D.Analyze network traffic to detect any malicious communications initiated by explorer.exe.
• E.Set breakpoints at the process injection-related API calls in a debugger.

答えを確認する

正解:

Question No : 9
What is the primary objective of conducting a static analysis on a suspected malware file?

• A.To immediately identify and delete malware from the system
• B.To observe the malware's interaction with its environment in real-time
• C.To gather information about the malware without executing it
• D.To determine the internet domains to which the malware communicates

答えを確認する

正解:

Question No : 10
When using a debugger on .NET malware, what would be a primary reason to set a breakpoint at a specific method?

• A.To observe the values of arguments passed to the method at runtime
• B.To change the execution flow of the program
• C.To prevent the malware from communicating over the network
• D.To decompile the entire assembly

答えを確認する

正解:

Question No : 11
When analyzing a Windows executable, which of the following indicators most strongly suggests that the file is packed?

• A.The file has a high entropy value.
• B.The file contains numerous readable strings.
• C.The file size is unusually large for its functionality.
• D.The executable has multiple sections named with standard names (e.g., .text, .data).

答えを確認する

正解:

Question No : 12
What is a key indicator that JavaScript code has been obfuscated?

• A.Presence of detailed comments
• B.Consistent use of meaningful variable names
• C.Unusual or inconsistent formatting and encoding
• D.Frequent use of JavaScript best practices

答えを確認する

正解:

Question No : 13
API hooking implemented by malware is primarily used for which purpose?

• A.Increasing the speed of the malware execution
• B.Making the malware more detectable
• C.Intercepting and possibly altering the function calls, messages, or events passed between software components
• D.Simplifying the malware code

答えを確認する

正解:

Question No : 14
What is the primary reason attackers pack malware binaries?

• A.To optimize the code for execution
• B.To hide the true size of the malware
• C.To make it harder for analysts to reverse-engineer the malware
• D.To bypass network-based detection systems

答えを確認する

正解:

Question No : 15
What is a common indicator that a function in assembly language is about to return a value?

• A.A PUSH instruction
• B.A MOV instruction to the stack
• C.A RET instruction
• D.A JMP instruction

答えを確認する

正解: