GREM Exam Questions
192 real GREM exam questions with expert-verified answers and explanations. Page 4 of 4.
- Question #151
What is the purpose of employing anti-disassembly techniques in malware?
- Question #152
In the context of reversing malware, what is the role of static analysis?
- Question #153
Process hollowing is a technique used by malware. What is the final step in this process?
- Question #154
What is a key indicator that an RTF file contains embedded malicious content?
- Question #155
What does it imply if a .NET malware sample contains calls to the System.Reflection.Assembly.Load method?
- Question #156
In the context of overcoming misdirection techniques, why is single-stepping through code important?
- Question #157
In the context of malware analysis, what is the significance of detecting packed or encrypted sections within a binary?
- Question #158
Which tool can be used to extract shellcode from a malicious RTF file for further analysis?
- Question #159
Which Windows event is MOST useful for mapping malware persistence?
- Question #160
Which dynamic observation MOST reliably confirms keylogging behavior?
- Question #161
During memory analysis you detect an injected PE image missing the MZ header. What technique is MOST likely?
- Question #162
A sample uses heavy obfuscation and multiple layers of unpacking. Which approach is MOST effective?
- Question #163
A malware modifies the Import Address Table of a process at runtime. Which technique is being used?
- Question #164
What can the analysis of import tables in an executable reveal about suspected malware?
- Question #165
What is the main purpose of using the SetWindowsHookEx function in malware?
- Question #166
Which of the following best describes the process of unpacking malware?
- Question #167
In malware analysis, what is the purpose of comparing the hash of a suspicious file to known malware databases?
- Question #168
Which of the following indicators should raise suspicion when analyzing the contents of an RTF file? (Choose Two)
- Question #169
How can an analyst use the entropy value of a file during malware analysis?
- Question #170
What aspect of an embedded object within an RTF file is crucial to analyze for determining potential malicious intent?
- Question #171
Why is it important to identify and understand conditional branches when analyzing assembly code?
- Question #172
How can malware attempt to detect and respond to being run in a virtual machine? (Choose Three)
- Question #173
Which of the following instructions is used to transfer control back to the calling function?
- Question #174
Which are common methods for analyzing malicious software? (Choose Two)
- Question #175
Which Windows API most strongly indicates credential harvesting?
- Question #176
A sample performs periodic DNS queries with base64 encoded payloads. What is this behavior?
- Question #177
Which tool is BEST suited for analyzing stack traces during a debugger session?
- Question #178
You see a PE section with very high entropy and no readable strings. What is the MOST likely condition?
- Question #179
You are analyzing a suspicious PDF document that was flagged by antivirus software. Initial inspection shows that the PDF contains a JavaScript action triggering upon document open...
- Question #180
What is a common technique used by malware to detect the presence of a debugger?
- Question #181
When analyzing an RTF file, which of the following strings would likely indicate the presence of an embedded object or shellcode?
- Question #182
What is a potential sign of malicious activity within a PDF file?
- Question #183
When analyzing a function in assembly language, how can you identify the function's parameters?
- Question #184
You are analyzing a malware sample and notice it uses multiple JMP instructions that lead to dead code segments, making it difficult to follow the actual execution flow. What steps...
- Question #185
What is the significance of identifying obfuscated code within a macro?
- Question #186
You are performing behavioral analysis on a malware sample that makes unusual DNS queries and writes data to a specific registry key. Which actions should you take to further inves...
- Question #187
Which of the following is a fundamental step in malware analysis before executing a sample?
- Question #188
You are performing malware analysis on a suspicious executable. The sample creates multiple new processes, modifies the registry, and connects to external IP addresses during execu...
- Question #189
When analyzing a macro within a Microsoft Office file, which of the following indicators would likely suggest malicious intent?
- Question #190
Which of the following components are essential for a well-equipped malware analysis lab? (Choose Two)
- Question #191
Which of the following methods can be used to analyze a suspicious PDF document? (Choose Two)
- Question #192
In the x86 calling convention, where is the return address of a function typically stored?