350-201 Question 188
Single answerAn organization detects suspicious activity on its network and captures a binary file suspected to be malware. As a cybersecurity analyst, you are tasked with performing reverse engineering on the file to understand its behavior. What is the primary reason you would use a disassembler during this process?
- A
To convert the binary file into a human-readable high-level programming language
- B
To execute the binary file in a secure sandbox environment and observe its behavior
- C
To analyze the binary file and convert it into assembly code for deeper analysis
- D
To extract network traffic data generated by the binary file during execution
Show answer and explanation
Correct answer: C
Explanation
Reverse engineering often involves understanding the low-level functionality of a binary file. A disassembler is a key tool in this process as it converts the binary into assembly code, making it possible to analyze the instructions and logic used by the malware. Unlike high-level languages, assembly code closely reflects the actual operations performed by the system, providing valuable insights for cybersecurity analysis.
- A. Incorrect.
This option is incorrect because a disassembler does not convert binary files into high-level programming languages. Instead, it converts them into assembly code, which is closer to machine instructions.
- B. Incorrect.
This option is incorrect because executing the binary file in a sandbox is dynamic analysis, not reverse engineering using a disassembler.
- C. Correct.
This option is correct because a disassembler is used to convert binary code into assembly code. This allows analysts to understand the low-level instructions and logic of the binary.
- D. Incorrect.
This option is incorrect because extracting network traffic data is typically done using network analysis tools, not a disassembler.