350-201 Question 190
Select 3During a cybersecurity investigation, you suspect a file contains malicious behavior. You decide to perform dynamic malware analysis using a sandbox environment. Which of the following steps are required to ensure accurate analysis results?
- A
Ensure the sandbox environment is isolated from the production network.
- B
Execute the suspected file in a virtualized sandbox and monitor its behavior.
- C
Disable logging in the sandbox to avoid performance overhead.
- D
Compare the file’s behavior in the sandbox environment against a known baseline.
- E
Use only static analysis tools to validate the file in the sandbox.
Show answer and explanation
Correct answers: A, B, D
Explanation
Dynamic malware analysis relies on executing a suspected file in a controlled and isolated environment to observe its behavior. To ensure accurate results, the sandbox must be isolated to prevent escape, logging must be enabled to capture detailed insights, and the observed behavior should be compared against a baseline to detect anomalies. Static analysis and disabling logging are unrelated to or counterproductive for dynamic analysis.
- A. Correct.
Ensuring the sandbox environment is isolated is critical to preventing potential malware from escaping and impacting the production network.
- B. Correct.
Executing the file in a sandbox and monitoring its behavior allows you to observe any malicious activities, such as creating new processes, network connections, or file modifications.
- C. Incorrect.
Disabling logging in the sandbox would prevent you from capturing critical insights into the malware's behavior, making this an incorrect step.
- D. Correct.
Comparing the file's behavior against a known baseline helps identify deviations that could indicate malicious activity.
- E. Incorrect.
Static analysis is a separate process and does not involve real-time execution in a sandbox, making this option irrelevant to dynamic malware analysis.