200-201 Question 25
Single answerA security analyst is tasked with analyzing a suspicious file that was flagged by the organization's email gateway. The analyst uses a sandbox environment to execute the file and observes that it attempts to connect to multiple external IP addresses while modifying system registry keys. Which step should the analyst take next to determine if the file is malicious?
- A
Check the file's hash against a threat intelligence database.
- B
Submit the file directly to the production environment for further testing.
- C
Send the file to all employees to warn them about potential threats.
- D
Delete the file immediately to prevent further risk.
Show answer and explanation
Correct answer: A
Explanation
After observing suspicious behavior in a sandbox environment, such as external connections and registry modifications, the next logical step is to verify the file's hash against a threat intelligence database. This helps the analyst determine if the file is already a known threat, enabling faster response and mitigation actions. Other options pose unnecessary risks or fail to contribute to proper threat identification and prevention.
- A. Correct.
Checking the file's hash against a threat intelligence database is a critical step in determining if the file matches known malware signatures or has been reported as malicious.
- B. Incorrect.
Submitting the file to the production environment is highly risky as it could compromise live systems if the file is indeed malicious.
- C. Incorrect.
Sending the file to all employees is not a recommended action, as it could inadvertently spread a potential threat further within the organization.
- D. Incorrect.
Deleting the file immediately without further analysis could result in a missed opportunity to understand the nature of the threat and implement preventive measures.