300-215 Question 217
Select 3During a forensic investigation, you are analyzing a ThreatGrid report for a suspicious file. Which of the following components from the report would be most relevant in determining if the file exhibits malicious behavior?
- A
Network artifacts revealing connections to known malicious IPs
- B
Static analysis showing the file's metadata and headers
- C
Behavioral indicators of system modifications (e.g., registry changes, file creation)
- D
Threat scores provided by third-party reputation services without further context
- E
Execution process tree displaying the relationships between launched processes
Show answer and explanation
Correct answers: A, C, E
Explanation
When evaluating a ThreatGrid report during a forensic investigation, components that provide evidence of runtime behavior, system modifications, and network communications are the most relevant. These include network artifacts, behavioral indicators, and the execution process tree. While static analysis and external threat scores can be useful supplementary data, they do not directly demonstrate malicious behavior exhibited during execution, which is critical for incident response and forensic analysis.
- A. Correct.
Network artifacts revealing connections to known malicious IPs are critical as they can indicate potential command-and-control communication or data exfiltration to unauthorized entities.
- B. Incorrect.
While static analysis of metadata and headers is useful for initial assessment, it does not directly reveal malicious behavior or runtime actions, making it less immediately relevant for behavioral analysis.
- C. Correct.
Behavioral indicators such as registry modifications or file creations are key signs of potentially harmful activities and should be evaluated closely in a forensic investigation.
- D. Incorrect.
Threat scores from third-party reputation services may provide insights but lack the detailed context required to conclusively determine malicious behavior.
- E. Correct.
The execution process tree is invaluable for understanding how processes interact and whether malicious activity propagates through the system, making it a highly relevant component.