3.6 Interpret the Output Report of Malware Analysis Tools Such as a Detonation Chamber or Sandbox 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An analyst is comparing two sandbox reports for the same malware sample. Report A shows the malware creating a file in the Startup folder and modifying the Run registry key. Report B shows the malware creating a mutex and writing a file to %Temp%. Which report provides stronger evidence of persistence?

   • AReport A, because the Startup folder and Run key are standard persistence mechanisms.
   • BNeither report provides evidence of persistence because sandbox reports are unreliable.
   • CReport B, because a mutex is a stronger indicator of persistence.
   • DBoth reports are equally strong because they show file system activity.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A sandbox report for a suspicious executable shows no network activity, but the analyst knows the sample is designed to communicate with a C2 server. The sandbox was configured with a simulated network that blocks all outbound connections. Which conclusion is most accurate?

   • AThe lack of network activity is expected because the sandbox blocked outbound connections, so the report is inconclusive regarding C2 behavior.
   • BThe sample is a keylogger that only operates locally.
   • CThe sample is not malicious because it did not attempt any network connections.
   • DThe sample is a worm that spreads via USB drives.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why do security analysts use a detonation chamber or sandbox when analyzing a suspicious file?

   • ATo permanently delete the file from the analyst's workstation
   • BTo validate the file's digital signature and confirm its publisher
   • CTo execute the file in an isolated environment and observe its behavior without risking the production network
   • DTo convert the file into a safe, non-executable format for storage
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An analyst is reviewing a sandbox report to extract IOCs for a threat hunt. The report shows the malware contacting an IP address, a domain, and a file hash. Which IOC would be the most stable and useful for detecting the malware across multiple endpoints?

   • AThe file hash
   • BThe IP address
   • CThe combination of IP and domain
   • DThe domain name
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following items extracted from a sandbox report is an example of a file-based indicator of compromise (IOC)?

   • AThe IP address of the C2 server
   • BThe SHA256 hash of the analyzed sample
   • CThe registry key modified by the malware
   • DThe domain name used for DNS queries
   Reveal Solution Discussion Select an answer first