200-201 Question 206
Select 3A cybersecurity analyst is investigating a suspected phishing email that was reported by an employee. The email contains a suspicious attachment and a link to a website. The analyst extracts the attachment and uploads it to a sandbox environment, which detects it as a malware sample. They also perform a WHOIS lookup on the domain in the link and find it was registered just two days ago using a known malicious registrar. How should the analyst use corroborative evidence to confirm the phishing attack?
- A
Compare the malware signature from the attachment with threat intelligence feeds for known indicators of compromise (IOCs).
- B
Check the organization's email logs for other instances of the same email being sent to employees.
- C
Block the domain in the organization’s firewall without further investigation.
- D
Verify if the domain in the link has been flagged in public threat intelligence databases.
- E
Inform the employee that the attachment was safe based only on the WHOIS lookup results.
Show answer and explanation
Correct answers: A, B, D
Explanation
Corroborative evidence involves gathering multiple pieces of independent evidence to confirm or refute a suspicion. In this scenario, analyzing the malware signature, checking email logs for patterns, and verifying the domain against threat intelligence databases all contribute to building a more complete and reliable picture of the phishing attack. Acting or making conclusions without sufficient corroborative evidence can lead to errors in handling the incident.
- A. Correct.
Comparing the malware signature with threat intelligence feeds helps to validate if the attachment is a known threat, providing corroborative evidence to support the suspicion.
- B. Correct.
Checking the organization's email logs for similar emails can help identify if this is part of a larger phishing campaign, adding to the evidence.
- C. Incorrect.
Blocking the domain without further investigation is premature and does not involve gathering corroborative evidence first.
- D. Correct.
Verifying the domain against public threat intelligence databases can provide additional context, such as whether it has been associated with malicious activity before.
- E. Incorrect.
Informing the employee without proper analysis of the attachment and domain does not involve using corroborative evidence and could lead to incorrect conclusions.