200-201 Question 383
Select 4You are a junior cybersecurity analyst investigating a suspicious process running on a Windows server. You decide to use Task Manager to analyze the process. Which of the following actions would be most appropriate to identify its legitimacy and potential threat?
- A
Check the process name and compare it with known legitimate processes.
- B
Terminate the process immediately to prevent potential damage to the system.
- C
Analyze the process's file location and verify if it matches the expected path of a legitimate application.
- D
Search for the process name online to check if it is associated with malware or legitimate software.
- E
Run a manual malware scan on the process's associated file.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
When investigating a suspicious process, it is crucial to follow a systematic approach: verify the process name against known processes, analyze its file location, search for additional information online, and run a malware scan to confirm its legitimacy. Terminating the process prematurely can cause system disruptions and should only be done after thorough investigation.
- A. Correct.
Checking the process name and comparing it with known legitimate processes is a valid initial step to determine if it appears suspicious.
- B. Incorrect.
Terminating a process immediately without investigation can disrupt legitimate system operations and should only be done as a last resort.
- C. Correct.
Analyzing the file location is essential because legitimate processes typically run from specific directories. A mismatch might indicate malicious activity.
- D. Correct.
Searching for the process name online can provide valuable insights, as malware and legitimate processes often have documented information available.
- E. Correct.
Running a manual malware scan on the process's associated file is a proactive step to confirm if the file is malicious.