300-215 Question 83
Select 4During a forensic investigation using Cisco Secure Endpoint (formerly AMP for Endpoints), you observe a suspicious process running on a compromised endpoint. Which of the following actions should you take to analyze the process and determine if it is malicious?
- A
Examine the process hash and check it against threat intelligence feeds.
- B
Inspect the command-line arguments used to initiate the process.
- C
Terminate the process immediately to prevent further damage.
- D
Review the process's parent and child relationships for unusual behavior.
- E
Analyze the process's memory dump using Cisco Secure Malware Analytics.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To conduct thorough process analysis during a forensic investigation, it is essential to gather as much evidence as possible. Examining the process hash, command-line arguments, parent/child relationships, and analyzing the memory dump are all critical steps for identifying and understanding malicious processes. Terminating the process prematurely may prevent further damage but should be done cautiously to avoid losing valuable forensic evidence.
- A. Correct.
Examining the process hash and checking it against threat intelligence feeds helps determine if the process is known to be malicious based on existing databases.
- B. Correct.
Inspecting the command-line arguments can provide insights into how the process was initiated and whether it exhibits potentially malicious behavior.
- C. Incorrect.
Terminating the process immediately might hinder the forensic investigation by destroying evidence. This action should only be taken after sufficient analysis or if the process poses an immediate and critical threat.
- D. Correct.
Reviewing the process's parent and child relationships is crucial to understanding its behavior and identifying other potentially compromised or malicious processes.
- E. Correct.
Analyzing the process's memory dump using Cisco Secure Malware Analytics allows deeper investigation into the process's behavior, including any malicious payloads or activities.