A sandbox report for a Windows executable shows the following behaviors. Which behaviors are strong indicators of persistence? (Select all that apply.)

Installing a Windows service set to auto-start

Making a DNS query to a known domain

Creating a mutex to prevent multiple instances

Adding a value to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key

Creating a scheduled task that runs at logon

A sandbox report shows a binary that performs the following actions: creates a mutex, writes a file to %Temp%, modifies the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run, and then makes an HTTP POST request to a URL with a parameter that looks like a unique identifier. Which malware category is most consistent with this behavior?

A keylogger that captures keystrokes

A worm that spreads via network shares

Ransomware that encrypts files and demands payment

A trojan that establishes persistence and phones home with a unique identifier

A sandbox report shows a process making repeated DNS queries for random subdomains under a single domain, and then sending small UDP packets to the resolved IPs. What is the most likely purpose of this behavior?

A denial-of-service attack against the DNS server

Normal DNS caching behavior by the operating system

A misconfigured application trying to reach a legitimate service

Domain generation algorithm (DGA) communication to evade domain blocklists

A sandbox report shows a sample that enumerates all files on the system, attempts to open network shares, and then sends a large amount of data over SMB to an external IP. Which malware category does this behavior most strongly suggest?

Data exfiltration malware or a stealer

CiscoCertified CyberOps Associate

Domain 3Objective 6

3.6 Interpret the Output Report of Malware Analysis Tools Such as a Detonation Chamber or Sandbox 200-201 Practice Questions (Page 6)

Part of the 3.0 Host-Based Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

20%of the exam

Questions 26–30

26application · medium · select all that apply
A sandbox report for a Windows executable shows the following behaviors. Which behaviors are strong indicators of persistence? (Select all that apply.)
Select an answer first
27expert · hard
A sandbox report shows a binary that performs the following actions: creates a mutex, writes a file to %Temp%, modifies the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run, and then makes an HTTP POST request to a URL with a parameter that looks like a unique identifier. Which malware category is most consistent with this behavior?
Select an answer first
28application · easy
An analyst is reviewing a sandbox report and wants to quickly determine if the sample modified any files that are critical to the operating system. Which section of the report should the analyst examine first?
Select an answer first
29application · medium
A sandbox report shows a process making repeated DNS queries for random subdomains under a single domain, and then sending small UDP packets to the resolved IPs. What is the most likely purpose of this behavior?
Select an answer first
30application · medium
A sandbox report shows a sample that enumerates all files on the system, attempts to open network shares, and then sends a large amount of data over SMB to an external IP. Which malware category does this behavior most strongly suggest?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

3.6 Interpret the Output Report of Malware Analysis Tools Such as a Detonation Chamber or Sandbox 200-201 Practice Questions (Page 6)

Questions 26–30

A sandbox report for a Windows executable shows the following behaviors. Which behaviors are strong indicators of persistence? (Select all that apply.)

An analyst is reviewing a sandbox report and wants to quickly determine if the sample modified any files that are critical to the operating system. Which section of the report should the analyst examine first?

A sandbox report shows a process making repeated DNS queries for random subdomains under a single domain, and then sending small UDP packets to the resolved IPs. What is the most likely purpose of this behavior?

A sandbox report shows a sample that enumerates all files on the system, attempts to open network shares, and then sends a large amount of data over SMB to an external IP. Which malware category does this behavior most strongly suggest?

Keep studying — 3.0 Host-Based Analysis