GREM 시험 - GIAC실제시험문제와 답 - 172문항

Question No : 1

What is the purpose of employing anti-disassembly techniques in malware?

A.To create efficient code
B.To optimize the execution speed
C.To hinder static analysis by analysts and automated tools
D.To improve compatibility with different system architectures

정답:

Question No : 2

Which of the following indicators suggest the presence of .NET malware in a system? (Choose two)

A.Executable files with .exe extensions
B.Usage of mscorlib.dll
C.Extensive use of string decryption functions
D.Packed binary sections

정답:

Question No : 3

Which assembly instruction is commonly used to alter the flow of execution in malware?

A.MOV
B.JMP
C.PUSH
D.RET

정답:

Question No : 4

In reverse engineering .NET malware, what does dynamic analysis allow you to observe?

A.The source code in its original high-level language
B.How the application interacts with its environment in real-time
C.The static set of APIs called by the application
D.The file size and checksum

정답:

Question No : 5

Which API calls are commonly used by malware to manipulate processes and inject code? (Choose two)

A.VirtualAllocEx()
B.WriteProcessMemory()
C.SendMessage()
D.NtQueryInformationFile()

정답:

Question No : 6

Which of the following is a common obfuscation technique used in .NET malware?

A.String encryption
B.Packed sections
C.Code injection
D.Process hollowing

정답:

Question No : 7

Which of the following are common flow control instructions used in malware? (Choose two)

A.JMP
B.XOR
C.CALL
D.POP

정답:

Question No : 8

You are analyzing a malware sample that appears to inject malicious code into the explorer.exe process. During execution, the malware creates a remote thread in explorer.exe and uses API calls to manipulate its memory.
How would you proceed with the analysis? (Choose three)

A.Monitor the API calls used for process injection, such as VirtualAllocEx() and CreateRemoteThread().
B.Dump the memory of the explorer.exe process and search for injected code.
C.Use a tool like Procmon to observe filesystem activity.
D.Analyze network traffic to detect any malicious communications initiated by explorer.exe.
E.Set breakpoints at the process injection-related API calls in a debugger.

정답:

Question No : 9

What is the primary objective of conducting a static analysis on a suspected malware file?

A.To immediately identify and delete malware from the system
B.To observe the malware's interaction with its environment in real-time
C.To gather information about the malware without executing it
D.To determine the internet domains to which the malware communicates

정답:

Question No : 10

When using a debugger on .NET malware, what would be a primary reason to set a breakpoint at a specific method?

A.To observe the values of arguments passed to the method at runtime
B.To change the execution flow of the program
C.To prevent the malware from communicating over the network
D.To decompile the entire assembly

정답:

Question No : 11

When analyzing a Windows executable, which of the following indicators most strongly suggests that the file is packed?

A.The file has a high entropy value.
B.The file contains numerous readable strings.
C.The file size is unusually large for its functionality.
D.The executable has multiple sections named with standard names (e.g., .text, .data).

정답:

Question No : 12

What is a key indicator that JavaScript code has been obfuscated?

A.Presence of detailed comments
B.Consistent use of meaningful variable names
C.Unusual or inconsistent formatting and encoding
D.Frequent use of JavaScript best practices

정답:

Question No : 13

API hooking implemented by malware is primarily used for which purpose?

A.Increasing the speed of the malware execution
B.Making the malware more detectable
C.Intercepting and possibly altering the function calls, messages, or events passed between software components
D.Simplifying the malware code

정답:

Question No : 14

What is the primary reason attackers pack malware binaries?

A.To optimize the code for execution
B.To hide the true size of the malware
C.To make it harder for analysts to reverse-engineer the malware
D.To bypass network-based detection systems

정답:

Question No : 15

What is a common indicator that a function in assembly language is about to return a value?

A.A PUSH instruction
B.A MOV instruction to the stack
C.A RET instruction
D.A JMP instruction

정답:

GIAC GREM 시험