Free practice test
GREMFree GIAC Reverse Engineering Malware (GREM) practice test
10 original GREM questions, playable right now. No account, no card, no email gate. Every answer opens the full explanation: the concept, why the right option is right, and why each wrong option is wrong, cited to the authoritative documentation behind it.
Sample question 1 of 10
An analyst finds malware creating a recurring job so its payload runs on a schedule. Which ATT&CK technique covers abusing the Windows Task Scheduler this way?
Sample question 2 of 10
A reverse engineer traces a call to OutputDebugString inside a suspected anti-analysis routine. What is the documented behavior of that function?
Sample question 3 of 10
A stomped document runs its hidden p-code on one Office build but recompiles benign source on another. Which stored value decides which path the host takes?
Sample question 4 of 10
After a call to malloc, an analyst sees test rax, rax and jz error_exit. When is the branch taken?
Sample question 5 of 10
A dropper's second stage never appears on disk and the debugger reports no LOAD_DLL event for it, yet its code runs inside the dropper's own process. Which technique is this?
Sample question 6 of 10
An analyst pulls a strong-named assembly's identity fields from its manifest. Which item belongs to that identity?
Sample question 7 of 10
After cleaning a host, a team finds the malware returns at every login because of a value under a Registry Run key. Which ATT&CK behavior is this?
Sample question 8 of 10
A malware analyst sees a sample stuck in a loop calling OutputDebugStringW to fill the debug log with junk. What anti-analysis purpose does this serve?
Sample question 9 of 10
A PDF holds a name dictionary whose JavaScript name tree maps names to script actions. An analyst asks when these document-level scripts run. What does the specification state?
Sample question 10 of 10
An analyst sees cmp eax, 5 followed by jl short loc_4010. What happens to EAX when the compare executes?
Full GREM question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
What this test covers
These 10 questions are drawn across the published exam blueprint rather than from one chapter: this set touches Malware Analysis and Reverse Engineering Fundamentals, Anti-Analysis and Obfuscation, Malicious Document Analysis, Assembly and Code Structures, Unpacking and Debugging Packed Malware, Common Malware Patterns and .NET Malware. Every question is original, written from the official objectives, and verified against a cited vendor page before it serves. None are recalled exam content, which is why the explanations can cite their sources.
A 10-question sample tells you where you stand, not whether you are ready. The full experience is numbered practice exams: 66 questions apportioned to the official domain weightings, sat under the real 180-minute clock and scored against the published cut score.
Other free GIAC practice tests
Keep reading
- GREM practice questions
Free sample questions with the full explanation on every answer.
- GREM exam format
How many questions, how long, what the items look like, and how long it stays valid.
- GREM passing score
The exact cut score, what kind of number it is, and the retake terms.
- How hard is GREM?
An honest difficulty read from the format, the clock and the weights.