QUESTION: 9

A security team receives reports of multiple files causing suspicious activity on users’ workstations. The file attempted to access highly confidential information in a centralized file server. Which two actions should be taken by a security analyst to evaluate the file in a sandbox? (Choose two.)

Inspect registry entries
Inspect processes.
Inspect file hash.
Inspect file type.
Inspect PE header.

Answer(s): B,C

Reference:

https://medium.com/@Flying_glasses/top-5-ways-to-detect-malicious-file-manually-d02744f7c43a

Reveal Solution Next Question

QUESTION: 10

Refer to the exhibit.

An engineer is analyzing a .LNK (shortcut) file recently received as an email attachment and blocked by email security as suspicious. What is the next step an engineer should take?

Delete the suspicious email with the attachment as the file is a shortcut extension and does not represent any threat.
Upload the file to a virus checking engine to compare with well-known viruses as the file is a virus disguised as a legitimate extension.
Quarantine the file within the endpoint antivirus solution as the file is a ransomware which will encrypt the documents of a victim.
Open the file in a sandbox environment for further behavioral analysis as the file contains a malicious script that runs on execution.

Answer(s): D

Reveal Solution Next Question

QUESTION: 11

An investigator is analyzing an attack in which malicious files were loaded on the network and were undetected. Several of the images received during the attack include repetitive patterns. Which anti-forensic technique was used?

spoofing
obfuscation
tunneling
steganography

Answer(s): D

Reference:

https://doi.org/10.5120/1398-1887
https://www.carbonblack.com/blog/steganography-in-the-modern-attack-landscape/

Reveal Solution Next Question

QUESTION: 12

A security team detected an above-average amount of inbound tcp/135 connection attempts from unidentified senders. The security team is responding based on their incident response playbook. Which two elements are part of the eradication phase for this incident? (Choose two.)

anti-malware software
data and workload isolation
centralized user management
intrusion prevention system
enterprise block listing solution

Answer(s): C,D

Reveal Solution Next Question

Free 300-215 Exam Braindumps (page: 3)

QUESTION: 9

Reference:

QUESTION: 10

QUESTION: 11

Reference:

QUESTION: 12