3.6 Interpret the Output Report of Malware Analysis Tools Such as a Detonation Chamber or Sandbox 200-201 Practice Questions (Page 9)

Questions 41–43

1. 41foundation · easy

   In a sandbox report, which network activity pattern is most indicative of data exfiltration?

   • AA large volume of HTTP POST requests to an external IP address
   • BA single DNS query to a popular website
   • CA TCP handshake with a local network printer
   • DAn HTTPS connection to a well-known software update server
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A sandbox report for a PDF file shows a DNS query for a domain that was registered 3 days ago, followed by an HTTPS connection to an IP address in a country where the company has no business. The domain was not present in any threat intel feed. What should the analyst conclude from this network activity?

   • AThe activity is benign because the domain is not on a threat intel blocklist
   • BThe PDF is using a legitimate update service because HTTPS is encrypted
   • CThe connection is a false positive caused by the sandbox environment
   • DThe domain and IP are likely indicators of command-and-control and should be added to a watchlist
   Reveal Solution Discussion Select an answer first
3. 43foundation · easy

   What is the primary benefit of using a sandbox to analyze malware compared to running it on a live production host?

   • AThe sandbox guarantees the malware will be fully detonated and all behaviors revealed
   • BThe sandbox contains the malware's impact and prevents it from spreading to other systems
   • CThe sandbox automatically removes the malware from the internet
   • DThe sandbox provides a faster analysis than any static method
   Reveal Solution Discussion Select an answer first