350-201 Question 218
Select 4You are investigating a suspicious file in a sandbox environment. The sandbox generates the following indicators: a connection to an external IP address categorized as malicious, repeated attempts to disable endpoint protection services, and the creation of a scheduled task to execute a file at system startup. Based on these indicators of compromise (IOCs), which actions should you prioritize to mitigate the threat?
- A
Block the external IP address at the firewall and monitoring systems
- B
Investigate the endpoint further for additional artifacts and disable any suspicious scheduled tasks
- C
Ignore the IOCs as they may be false positives
- D
Quarantine the file and any associated processes on the affected endpoint
- E
Perform a system-wide antivirus scan to detect other potential infections
Show answer and explanation
Correct answers: A, B, D, E
Explanation
The IOCs generated by the sandbox indicate malicious behavior, such as external communication with a known malicious IP, attempts to disable security services, and persistence mechanisms. To mitigate the threat, actions such as blocking external communication, investigating and removing persistence mechanisms, quarantining the malicious file, and scanning for additional infections should be prioritized.
- A. Correct.
Blocking the external IP address prevents the malicious file from communicating with its command-and-control server, mitigating potential data exfiltration or further instructions.
- B. Correct.
Investigating the endpoint and removing the scheduled task ensures that the malicious activity does not persist after a system reboot.
- C. Incorrect.
Ignoring the IOCs is not a valid action, as they are critical indicators of malicious behavior that need to be addressed to secure the environment.
- D. Correct.
Quarantining the file and associated processes stops the immediate threat and prevents further damage from the malicious file.
- E. Correct.
Performing a system-wide antivirus scan helps identify and remediate other potential infections that may have been missed during the initial investigation.