300-215 Question 216
Select 3You are investigating a suspicious file using Cisco ThreatGrid. Upon reviewing the ThreatGrid report, which of the following components should be prioritized to determine if the file exhibits malicious behavior?
- A
Behavioral Indicators that show high-severity actions performed by the file
- B
Network Activity logs detailing connections to known malicious IP addresses
- C
File Hash comparison against Cisco Talos threat intelligence database
- D
Static Analysis results showing the names of all functions within the file
- E
Reputation score of the file based on global threat intelligence
Show answer and explanation
Correct answers: A, B, E
Explanation
When evaluating a ThreatGrid report, components such as Behavioral Indicators, Network Activity, and Reputation score are the most relevant for identifying malicious behavior. These components provide insight into the file's actions, its communication patterns, and its overall risk profile. While File Hash comparisons and Static Analysis may offer supplementary information, they are less critical for immediate threat evaluation.
- A. Correct.
Behavioral Indicators are critical as they highlight potentially malicious actions taken by the file, such as modifying system files, injecting code, or disabling security software.
- B. Correct.
Network Activity logs are essential because they can reveal whether the file is communicating with known malicious domains or IP addresses, a strong indicator of malicious intent.
- C. Incorrect.
File Hash comparisons can be informative, but on their own, they may not provide actionable details unless the hash is associated with a known malicious threat.
- D. Incorrect.
Static Analysis results listing function names are useful for development or debugging but are usually less relevant for immediate malicious behavior evaluation.
- E. Correct.
The Reputation score provides a high-level overview of the file's trustworthiness and can be a quick way to identify potential threats.