300-215 Question 62
Select 3During a forensic investigation, you are tasked with analyzing a suspicious file that was flagged by Cisco Secure Endpoint. Which of the following forensic techniques should you prioritize to determine if the file is malicious?
- A
Perform dynamic analysis by executing the file in a sandbox environment and monitoring its behavior.
- B
Inspect the file's metadata, such as creation date and author, to identify anomalies.
- C
Analyze the file's hash value and compare it against known malicious file databases.
- D
Use packet capture tools to monitor network traffic related to the suspicious file.
- E
Directly delete the file from the affected system to prevent further damage.
Show answer and explanation
Correct answers: A, C, D
Explanation
Effective forensic analysis of a suspicious file flagged by Cisco Secure Endpoint involves a combination of techniques to gather evidence and understand its behavior. Dynamic analysis, hash comparison, and network traffic monitoring are essential steps to identify potential malicious activity. Metadata inspection can provide supplementary information but is not sufficient by itself, and deleting the file prematurely can hinder the investigation process.
- A. Correct.
Performing dynamic analysis in a sandbox environment allows you to observe the file's behavior in a controlled setting, which can reveal malicious actions such as file modifications or network communications.
- B. Incorrect.
Inspecting the file's metadata can provide useful information, but it is not sufficient as a standalone forensic technique to determine whether the file is malicious.
- C. Correct.
Comparing the file's hash value against known malicious file databases is a reliable way to quickly identify if the file is associated with known threats.
- D. Correct.
Using packet capture tools to monitor network traffic can reveal if the file attempts to communicate with suspicious external IPs or domains, which is a common behavior of malicious files.
- E. Incorrect.
Deleting the file without conducting a thorough investigation can result in loss of forensic evidence and is not a recommended forensic practice.