300-215 Question 85
Single answerDuring a forensic investigation, you are analyzing processes on a compromised endpoint using Cisco Secure Endpoint. You notice an unknown executable running with high CPU usage and multiple instances of the same process initiated by different parent processes. Which action would best help you confirm whether this process is malicious?
- A
Inspect the command line arguments used to launch the process for anomalies.
- B
Terminate the process immediately to stop potential damage to the system.
- C
Check the process hash against Cisco Secure Malware Analytics (Threat Grid).
- D
Ignore the process since high CPU usage alone is not a definitive indicator of compromise.
Show answer and explanation
Correct answer: C
Explanation
To confirm whether a suspicious process is malicious, leveraging Cisco Secure Malware Analytics (Threat Grid) allows you to analyze the process hash against a database of known malicious files and behavioral indicators. This step enables you to make a data-driven determination while preserving forensic evidence.
- A. Incorrect.
Inspecting the command line arguments can provide clues about the process behavior, but this action alone is insufficient to confirm if the process is malicious.
- B. Incorrect.
Terminating the process may prevent further damage, but it should not be done without proper analysis as it can destroy evidence.
- C. Correct.
Checking the process hash against Cisco Secure Malware Analytics (Threat Grid) allows for a definitive analysis of whether the process is malicious based on threat intelligence and behavioral analysis.
- D. Incorrect.
Ignoring the process would leave a potentially malicious activity unchecked, which is not a recommended action in a forensic investigation.