A sandbox report for a Windows executable shows that it created a service named 'WindowsUpdateSvc', modified the security policy to disable Windows Defender, and then deleted the original executable. Which malware category does this behavior most strongly indicate?

Backdoor or remote access trojan (RAT)

A sandbox report shows no malicious activity for a file, but the analyst suspects the malware is evasive. Which report observation would most strongly support that suspicion?

The file checked the system time and then slept for 10 minutes before doing anything

The file made one DNS query to a well-known update domain

The file created a single benign-looking text file in the temp directory

The file ran in the sandbox for only 2 minutes and then exited

Why might a sandbox report fail to show malicious behavior even though the sample is known malware?

The malware may detect that it is running in a virtualized environment and delay its malicious actions

The sandbox prevents the malware from accessing the internet, which is the only way it can act

The sandbox automatically patches the malware's vulnerabilities

The sandbox always executes the malware with full administrative privileges

A sandbox report shows no network activity for a malware sample, but the analyst knows the malware is designed to exfiltrate data. Which limitation of sandbox analysis is most likely responsible for the lack of network activity?

The sandbox may have blocked or simulated network access, causing the malware to fail silently

The sandbox report is corrupted because network activity is always present

The malware only works on a 64-bit system and the sandbox used 32-bit

The malware is definitely benign because it did not make any network connections

CiscoCertified CyberOps Associate

Domain 3Objective 6

3.6 Interpret the Output Report of Malware Analysis Tools Such as a Detonation Chamber or Sandbox 200-201 Practice Questions (Page 1)

Part of the 3.0 Host-Based Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

20%of the exam

Questions 1–5

1foundation · easy
A sandbox report shows the malware encrypting files and displaying a ransom note. Which malware category does this behavior most strongly indicate?
Select an answer first
2application · medium
A sandbox report for a Windows executable shows that it created a service named 'WindowsUpdateSvc', modified the security policy to disable Windows Defender, and then deleted the original executable. Which malware category does this behavior most strongly indicate?
Select an answer first
3application · medium
A sandbox report shows no malicious activity for a file, but the analyst suspects the malware is evasive. Which report observation would most strongly support that suspicion?
Select an answer first
4foundation · easy
Why might a sandbox report fail to show malicious behavior even though the sample is known malware?
Select an answer first
5application · medium
A sandbox report shows no network activity for a malware sample, but the analyst knows the malware is designed to exfiltrate data. Which limitation of sandbox analysis is most likely responsible for the lack of network activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.