300-215 Question 193
Select 4An analyst is investigating a suspicious file that was flagged by Cisco Secure Endpoint. The file has an unknown hash value and exhibits abnormal behaviors when executed in a sandbox environment. Which of the following actions should the analyst recommend as the next steps in evaluating the file based on its characteristics?
- A
Submit the file to Cisco Threat Grid for advanced malware analysis.
- B
Perform a static analysis of the file to extract embedded metadata and strings.
- C
Ignore the file since it has no known malicious hash in threat intelligence databases.
- D
Quarantine the file and block its associated hash across enterprise devices.
- E
Correlate the file's characteristics with network traffic logs using Cisco Secure Network Analytics.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
When evaluating a suspicious file, it is critical to use multiple approaches to fully understand its behavior and impact. Submitting the file to Cisco Threat Grid provides dynamic and behavioral analysis, while static analysis can reveal detailed insights about its composition. Quarantining and blocking the file ensure it cannot cause harm. Correlating its characteristics with network traffic logs helps identify any related malicious activities. Ignoring the file is not a valid option as even unknown files can pose significant risks.
- A. Correct.
Submitting the file to Cisco Threat Grid provides advanced behavioral analysis and threat intelligence, helping to better understand the file's potential risk.
- B. Correct.
Static analysis can reveal useful information such as embedded commands, strings, and metadata that provide insights into the file's purpose and potential threats.
- C. Incorrect.
Ignoring the file is not a recommended step, as the absence of a known malicious hash does not guarantee the file is safe.
- D. Correct.
Quarantining the file and blocking its hash help to prevent further spread or execution of the potentially malicious file across the organization.
- E. Correct.
Correlating the file's characteristics with network traffic logs can help identify if the file has been involved in malicious activity, such as data exfiltration or command-and-control communications.