350-201 Question 192
Select 3You are tasked with analyzing a suspicious file that was flagged by your organization's endpoint detection system. To safely observe its behavior, you decide to use a sandbox environment. During this process, which of the following actions would help you successfully perform dynamic malware analysis?
- A
Monitor the file's interactions with system processes and network traffic in real-time.
- B
Ensure the sandbox mimics the target environment where the malware was detected.
- C
Use only static analysis tools to examine the file's code without executing it.
- D
Capture and analyze changes made to the file system and registry entries during execution.
- E
Disable any outbound network connections from the sandbox to prevent malware communication.
Show answer and explanation
Correct answers: A, B, D
Explanation
Dynamic malware analysis involves executing the malware in a controlled sandbox environment to observe its behavior. Key steps include monitoring system interactions, replicating the target environment to trigger the malware's functionality, and analyzing changes to the file system or registry. Static analysis or isolating the sandbox entirely from the network does not align with the goals of dynamic analysis, as it requires observing the malware's real-time operations in a simulated but realistic environment.
- A. Correct.
Monitoring system processes and network traffic in real-time is a key aspect of dynamic malware analysis. This allows you to observe the malware's behavior and interactions with the system.
- B. Correct.
Ensuring the sandbox mimics the target environment increases the likelihood that the malware will exhibit its intended behavior, as some malware may remain dormant or behave differently in unfamiliar environments.
- C. Incorrect.
Static analysis tools are used in a different phase of malware analysis and do not involve executing the file. Dynamic analysis specifically requires observing the malware in a controlled execution environment.
- D. Correct.
Capturing changes made to the file system and registry during execution is crucial for understanding the malware's impact on the system and identifying potential persistence mechanisms.
- E. Incorrect.
While disconnecting the sandbox from the network can prevent the malware from communicating externally, it may also prevent you from observing certain behaviors, such as data exfiltration or command-and-control communication, which are critical in dynamic analysis.