200-201 Question 381
Select 3A cybersecurity analyst is investigating a potential malware infection on a Windows workstation. During the investigation, the analyst observes an unknown process consuming high CPU and memory usage in the Task Manager. What should the analyst do next to determine if the process is malicious?
- A
Check the file path of the process to ensure it matches the expected location for legitimate software.
- B
Terminate the process immediately to stop any potential malicious activity.
- C
Search for the process name and hash in online threat intelligence databases.
- D
Analyze the process's network connections to identify any suspicious communication.
- E
Reboot the system to clear the process from memory.
Show answer and explanation
Correct answers: A, C, D
Explanation
To determine if a running process is malicious, an analyst should investigate its properties, such as file path, behavior, and network activity. This approach ensures comprehensive evidence collection without prematurely destroying critical artifacts or disrupting the investigation. Steps such as terminating the process or rebooting the system should only occur after adequate information is gathered.
- A. Correct.
Checking the file path helps verify if the process is running from a legitimate directory or if it is located in a suspicious location, which could indicate malware.
- B. Incorrect.
Terminating the process immediately could disrupt the investigation. The analyst should gather more information before taking such action.
- C. Correct.
Searching for the process in threat intelligence databases can help identify if it is associated with known malware or threats.
- D. Correct.
Analyzing network connections can reveal if the process is communicating with external suspicious servers, helping determine if it is malicious.
- E. Incorrect.
Rebooting the system without further investigation can erase valuable evidence needed for analysis and does not address the root cause of the issue.