FirstTry
GREMGIAC Reverse Engineering Malware (GREM)

Practice Exam 1

5 of this form’s 66 questions, drawn from across its domains, free. The explanation on every one of them is free too, at every tier, and always will be.

  1. Question 1 of 5

    Assembly and Code Structures

    An analyst sees cmp eax, 5 followed by jl short loc_4010. What happens to EAX when the compare executes?

  2. Question 2 of 5

    Malware Analysis and Reverse Engineering Fundamentals

    An analyst finds malware creating a recurring job so its payload runs on a schedule. Which ATT&CK technique covers abusing the Windows Task Scheduler this way?

  3. Question 3 of 5

    Anti-Analysis and Obfuscation

    A reverse engineer traces a call to OutputDebugString inside a suspected anti-analysis routine. What is the documented behavior of that function?

  4. Question 4 of 5

    Unpacking and Debugging Packed Malware

    An engineer writing a small unpacking tool on the Windows debug API sets a software breakpoint at the suspected original entry point. Which event type reports the hit?

  5. Question 5 of 5

    Malicious Document Analysis

    An analyst finds a PDF stream whose bytes are unreadable and whose dictionary names a filter. To reveal the hidden script, which filter's decode is required for zlib-style data?

0 of 66 completed

0%

The other 61 questions are the rest of this form: same 180 minute clock, same 73 cut score, and the same explanation on every question, which is never behind the wall. Practice Exam 1 of 2 on GREM.

What this exam covers

  • Malware Analysis and Reverse Engineering Fundamentals14 questions / 22% of the exam
  • Assembly and Code Structures11 questions / 16% of the exam
  • Malicious Document Analysis12 questions / 18% of the exam
  • Anti-Analysis and Obfuscation12 questions / 18% of the exam
  • Unpacking and Debugging Packed Malware9 questions / 14% of the exam
  • Common Malware Patterns and .NET Malware8 questions / 12% of the exam

Checking what you already have access to.

Every question is original, written from the published objectives. We never reproduce, paraphrase, or imitate real exam content, and neither should anything else you study from.