Difficulty
GREMHow hard is GREM?
GIAC classifies GREM at the advanced level. It is 1 proctored exam, sat in 180 minutes. No invented pass rates anywhere on this page.
The short answer
GIAC Reverse Engineering Malware (GREM) is an advanced exam. It is written for experienced practitioners, and the questions assume judgment built from real work rather than memorized definitions.
With several years in the field, the difficulty is breadth: domains you have read about but never worked in. Without that experience, read the objectives list domain by domain before booking. It is the honest measure of how much of this is new to you.
What actually makes it hard
The items are not all multiple choice.
A CyberLive exam. Some of the questions put you into a live machine with the real tools and score what you do there. GIAC does not publish how many of the 66 are hands-on, so neither do we. They take longer than a multiple-choice question, and you have to perform the task rather than recognize an answer.
Breadth across domains.
The objectives cover 6 areas and the exam samples all of them. GIAC publishes no weighting, so nothing tells you which of them carry the most marks.
The clock.
66 questions in 180 minutes is about 2.7 minutes each, including the time to read the stem and the options. Reading about the exam does not rehearse that pace; a full-length sitting against the clock does.
Where the weight sits
Difficulty is not spread evenly, and GIAC publishes no weighting that says where it sits. The percentages below are ours:
- Malware Analysis and Reverse Engineering Fundamentals22%
- Malicious Document Analysis18%
- Anti-Analysis and Obfuscation18%
- Assembly and Code Structures16%
- Unpacking and Debugging Packed Malware14%
- Common Malware Patterns and .NET Malware12%
GIAC publishes the GREM objectives as an unweighted list covering malware and behavioral analysis fundamentals, core reverse engineering concepts, static analysis, reversing functions in assembly, flow control and structures, malicious Office macros, PDFs and RTF files, obfuscated malware, anti-analysis and misdirection techniques, unpacking and debugging packed malware, common malware patterns, and .NET malware. It attaches no percentages. The six groupings above and their percentages are ours, a study aid rather than an official GIAC weighting, and GIAC does not endorse them.
Where candidates struggle: GREM's 73 percent pass mark is among the highest GIAC sets, and the CyberLive items drop you into a debugger rather than a multiple choice list. Build a safe analysis VM and reverse real samples: recognizing a packer or an anti-analysis check by its behavior is faster under the clock than working it out from first principles.
How to find out where you stand
The fastest honest read on difficulty is not an opinion page, ours included. Answer real GREM questions and see which domains push back. Five questions from across every practice exam, with the full explanation on each.
Keep reading
- GREM practice questions
Free sample questions with the full explanation on every answer.
- Free GREM practice test
10 original questions, playable now. No account, no card.
- GREM exam format
How many questions, how long, what the items look like, and how long it stays valid.
- GREM passing score
The exact cut score, what kind of number it is, and the retake terms.
Practice GREM for free while you decide
Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.
Start free GREM questions