350-201 Question 178
Select 3You are a cybersecurity analyst tasked with analyzing a suspicious file detected in your organization's network. According to the malware analysis process, which steps should you follow to ensure a thorough investigation and understanding of the malware's behavior?
- A
Perform static analysis to examine the file's structure and metadata without executing it.
- B
Directly execute the file in a live production environment to observe its behavior in real-time.
- C
Use dynamic analysis to execute the file in a controlled sandbox environment and monitor its behavior.
- D
Correlate findings with threat intelligence sources to identify potential indicators of compromise (IOCs).
- E
Delete the file immediately to prevent further risk to the network.
Show answer and explanation
Correct answers: A, C, D
Explanation
The malware analysis process typically involves static analysis to gather initial insights about the file without execution, followed by dynamic analysis in a controlled environment to observe its behavior. Additionally, correlating findings with threat intelligence ensures a comprehensive understanding of the malware's nature and potential associations with known threats. Direct execution in a live environment or premature deletion of the file disrupts the analysis process and introduces unnecessary risks.
- A. Correct.
Performing static analysis is a critical step in the malware analysis process. It allows you to examine the file's properties, such as metadata, imports, and embedded strings, without the risk of execution.
- B. Incorrect.
Executing a suspicious file directly in a live production environment is highly risky and not recommended. This could cause the malware to spread or compromise systems further.
- C. Correct.
Dynamic analysis involves executing the file in a controlled sandbox environment, which is a safe method to observe its behavior and understand its impact.
- D. Correct.
Correlating findings with threat intelligence is an important part of the process as it helps identify known patterns, IOCs, or related malware families.
- E. Incorrect.
Deleting the file immediately is not recommended during the analysis phase, as it prevents you from understanding its behavior and creating appropriate defenses.