300-215 Question 191
Select 3You are conducting a forensic analysis on a file flagged as suspicious in your environment. After identifying the file's hash and confirming it matches a known malware signature in Cisco Secure Malware Analytics, what should be your next step to further evaluate the file based on its distinguished characteristics?
- A
Perform static analysis on the file to inspect its structure and embedded metadata.
- B
Submit the file to Cisco Secure Endpoint for automated remediation.
- C
Analyze network traffic logs in Cisco Secure Network Analytics for evidence of communication initiated by the file.
- D
Conduct dynamic analysis in a sandbox environment to observe the file's behavior during execution.
- E
Delete the file immediately to prevent further damage to the system.
Show answer and explanation
Correct answers: A, C, D
Explanation
When evaluating a suspicious file based on its characteristics, it is essential to perform both static and dynamic analyses to understand its structure and behavior. Additionally, analyzing related network traffic can provide evidence of malicious activity, helping to build a comprehensive understanding of the file's impact. Immediate deletion of the file or remediation actions should only occur after completing these analyses and confirming its malicious nature.
- A. Correct.
Static analysis helps you understand the file's characteristics without executing it, which is useful for identifying embedded code, strings, or metadata within the file.
- B. Incorrect.
Submitting the file to Cisco Secure Endpoint is not the next logical step in evaluating the file's characteristics. This is more appropriate for remediation, not evaluation.
- C. Correct.
Analyzing network traffic logs in Cisco Secure Network Analytics allows you to determine if the suspicious file has initiated any unwanted or malicious connections, which can indicate its behavior.
- D. Correct.
Dynamic analysis in a sandbox environment enables you to observe the file's runtime behavior, which provides critical insights into its potential malicious actions.
- E. Incorrect.
Deleting the file immediately is not recommended during the evaluation phase, as it destroys evidence critical to understanding the file's characteristics and behavior.