350-201 Question 179
Select 4A security analyst at a financial institution is investigating a suspicious file detected on an employee's workstation. The analyst follows the malware analysis process to determine the file's behavior and potential impact. Which of the following steps should the analyst perform in the correct sequence to analyze the malware effectively?
- A
Perform static analysis to inspect the file's attributes and signatures.
- B
Execute the file in a sandbox environment to observe its behavior.
- C
Capture network traffic generated by the malware for further analysis.
- D
Document findings and create an actionable report for stakeholders.
- E
Reverse engineer the malware to study its internal code.
Show answer and explanation
Correct answers: A, B, C, D
Explanation
The malware analysis process involves a sequence of steps, starting with static analysis to inspect the file without execution, followed by dynamic analysis (sandboxing and network traffic capture) to observe the malware's behavior. Lastly, findings are documented in a report for stakeholders. Reverse engineering is not a mandatory step but can be performed for deeper insights if necessary.
- A. Correct.
Performing static analysis is typically the first step in malware analysis. It involves inspecting the file without executing it to identify its attributes, such as hashes, file structure, and embedded strings.
- B. Correct.
Executing the file in a sandbox is part of dynamic analysis, where the behavior of the malware is observed in a controlled environment to understand its impact.
- C. Correct.
Capturing network traffic is a critical step during dynamic analysis to identify any communication to command-and-control (C2) servers or data exfiltration attempts.
- D. Correct.
Documenting findings and creating a report is the final step in the malware analysis process. This ensures that all observations and actionable insights are shared with relevant stakeholders.
- E. Incorrect.
Reverse engineering malware is an advanced and optional step that may not always be performed unless deeper insights into the malware's internal workings are required.