350-201 Question 177
Select 3You are a security analyst in a SOC (Security Operations Center), and a suspicious file has been flagged on a user's workstation. Following the malware analysis process, what is the correct sequence of steps you should take to analyze and mitigate the potential threat?
- A
Perform static analysis to examine file characteristics without executing the file.
- B
Isolate the file in a sandbox environment and execute it to observe its behavior.
- C
Update endpoint protection software immediately after identifying the file.
- D
Extract indicators of compromise (IOCs) such as IP addresses or hashes for threat hunting.
- E
Directly delete the file from the workstation without further analysis.
Show answer and explanation
Correct answers: A, B, D
Explanation
The malware analysis process follows a structured approach: starting with static analysis to gather initial details, performing dynamic analysis in a safe environment, and extracting IOCs to enhance threat visibility and response. These steps allow security teams to understand the nature of the threat, mitigate risks, and improve future defenses. Direct deletion or unrelated actions like updating software are not part of the analysis process.
- A. Correct.
Correct: Static analysis is a critical first step in malware analysis to gather preliminary information such as file metadata, hashes, and embedded strings before executing the file.
- B. Correct.
Correct: Dynamic analysis, performed in a sandbox environment, is essential to safely observe the file's behavior in a controlled setting.
- C. Incorrect.
Incorrect: Updating endpoint protection software is part of a broader incident response process but is not a specific step in the malware analysis sequence.
- D. Correct.
Correct: Extracting IOCs is a key step to identify malicious artifacts and enable proactive threat hunting and prevention.
- E. Incorrect.
Incorrect: Deleting the file without proper analysis prevents the understanding of its behavior, potential spread, and impact, which is against the malware analysis best practices.