During incident response, an analyst extracts a suspicious file from an infected host and computes its SHA-256 hash. The analyst wants to determine if this file is already known to the security community. Which action should the analyst take?

Compare the hash to the file's digital signature

Run the file in a sandbox and observe its behavior

Decode the file with base64 and search the output

Submit the hash to a threat intelligence platform such as VirusTotal

What is the primary purpose of performing a hash lookup against a threat intelligence service such as VirusTotal?

To identify whether the file is known to be malicious

To find the file's original download source

To determine the file's creation date and author

CiscoCertified CyberOps Associate

Domain 3Objective 7

3.7 200-201 Practice Questions (Page 12)

Part of the 3.0 Host-Based Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

20%of the exam

Questions 56–59

56application · medium
A security analyst downloads a suspected malware sample from a sandbox and computes its SHA-256 hash. Later, the analyst queries a threat intelligence platform with that hash and receives a match. Which property of the hash function makes this match a reliable indicator that the file is the same one previously analyzed?
Select an answer first
57application · medium
During incident response, an analyst extracts a suspicious file from an infected host and computes its SHA-256 hash. The analyst wants to determine if this file is already known to the security community. Which action should the analyst take?
Select an answer first
58foundation · easy
An analyst finds an unknown executable on a compromised host. Which hash algorithm is most commonly used for querying threat intelligence feeds to identify the file?
Select an answer first
59foundation · easy
What is the primary purpose of performing a hash lookup against a threat intelligence service such as VirusTotal?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

3.7 200-201 Practice Questions (Page 12)

Questions 56–59

During incident response, an analyst extracts a suspicious file from an infected host and computes its SHA-256 hash. The analyst wants to determine if this file is already known to the security community. Which action should the analyst take?

An analyst finds an unknown executable on a compromised host. Which hash algorithm is most commonly used for querying threat intelligence feeds to identify the file?

What is the primary purpose of performing a hash lookup against a threat intelligence service such as VirusTotal?

Keep studying — 3.0 Host-Based Analysis