300-215 Question 190
Select 3As a cybersecurity analyst, you are investigating a potentially malicious file detected in your network. Preliminary analysis reveals that the file exhibits characteristics such as being an executable with an unusual file size and having a mismatched file extension. What should be your next steps to evaluate this file based on these characteristics?
- A
Perform a hash analysis and compare it against threat intelligence databases to check for known malicious signatures.
- B
Upload the file directly to a public malware analysis sandbox without any additional precautions.
- C
Conduct static analysis to examine the file's metadata, headers, and embedded strings for suspicious indicators.
- D
Execute the file in an isolated, controlled sandbox environment to observe its behavior.
- E
Delete the file immediately from the system to prevent further harm.
Show answer and explanation
Correct answers: A, C, D
Explanation
Evaluating a file based on its characteristics involves multiple steps, including hash analysis, static analysis, and dynamic analysis in a controlled environment. These methods collectively help determine whether the file is malicious and its potential impact. Uploading files to public sandboxes without precautions risks data exposure, and immediate deletion can prevent a thorough investigation.
- A. Correct.
Performing hash analysis allows you to determine whether the file is already identified as malicious by comparing its hash against threat intelligence databases. This is a critical first step in file evaluation.
- B. Incorrect.
Uploading a potentially malicious file to a public sandbox without precautions can expose sensitive information from your organization. This is not a recommended practice, especially for files containing confidential data.
- C. Correct.
Static analysis helps uncover valuable insights such as unusual file attributes, headers, or embedded strings that may indicate malicious intent. This is an essential part of file evaluation.
- D. Correct.
Executing the file in an isolated sandbox environment allows you to observe its real-time behavior, such as network communication or file modifications, without risking your production environment. This is a key step in understanding the file's intent.
- E. Incorrect.
Deleting the file immediately without performing a thorough analysis can result in loss of valuable forensic evidence and hinder the investigation. This is not recommended.