350-201 Question 186
Single answerWhile investigating a suspicious executable file found on a company server, you are tasked with performing reverse engineering to determine its behavior. Using Cisco Secure Malware Analytics (formerly Threat Grid), what is the most effective next step to identify if the executable is malicious and understand its actions?
- A
Upload the executable to Cisco Secure Malware Analytics and analyze the dynamic behavior in a safe sandbox environment.
- B
Directly execute the file on a production server to observe its behavior in a real-world environment.
- C
Disassemble the code manually using a tool like Ghidra or IDA Pro to analyze its static behavior.
- D
Quarantine the file and wait for the next scheduled Cisco Talos update for automatic threat detection.
Show answer and explanation
Correct answer: A
Explanation
The most effective and safe method to begin analyzing a suspicious executable is using Cisco Secure Malware Analytics to perform dynamic analysis in a sandbox environment. This allows the behavior of the file to be observed in isolation, reducing the risk to production systems while providing valuable insights into its actions. Other methods, while valid, are either unsafe or less efficient as an initial step.
- A. Correct.
Uploading the executable to Cisco Secure Malware Analytics allows safe dynamic analysis in a controlled sandbox environment, which can reveal the file's behavior without risking production systems.
- B. Incorrect.
Executing the file on a production server is highly risky as it could compromise the system and spread malicious activity across the network.
- C. Incorrect.
While manual disassembly using tools like Ghidra or IDA Pro is a valid reverse engineering method, it is time-consuming and may not be the most efficient first step, especially when automated dynamic analysis is available.
- D. Incorrect.
Quarantining the file and waiting for an update is a passive approach and does not provide immediate insights into the file's behavior or potential impact.