An analyst is performing static analysis on a Windows executable and finds a suspicious string that appears to be a URL. The analyst wants to determine if the URL is a command-and-control endpoint. Which static analysis technique would be most helpful?

Search the binary for other URLs using a strings tool.

Use a disassembler to find cross-references to the string in the code.

Run the executable in a sandbox and observe network connections.

Check the file's digital signature to see if it is signed by a known vendor.

You have a Linux malware sample. You need to identify its key logging behavior without executing it. Which static analysis technique is most likely to reveal this?

Run the sample in a sandbox and monitor system calls.

Inspect the ELF headers and look for imported functions related to input handling.

Use a debugger to step through the main function.

Submit the binary to VirusTotal and read the behavior report.

A malware analyst is using a sandbox to analyze a sample that is known to check for the presence of analysis tools such as Wireshark and Process Monitor. The sandbox has these tools installed. What is the most likely outcome?

The malware will crash because the tools interfere with its execution.

The malware will detect the tools and alter its behavior to avoid analysis.

The malware will not be affected by the presence of the tools.

The tools will automatically detect the malware and prevent it from running.

An analyst is investigating a malware infection and has a packet capture that includes multiple HTTP sessions, some of which are benign and some are malicious. The analyst needs to extract the malicious executable and confirm its behavior. The capture is large, and the analyst wants to minimize manual effort. Which approach is most efficient?

Use a malware hash lookup service to identify malicious files in the capture.

Run the entire packet capture through a sandbox to observe all network traffic.

Manually inspect every HTTP session in the capture to identify the malicious one.

Use a network analysis tool to filter for suspicious HTTP objects, export them, and then analyze each one in a sandbox.

You are reverse engineering a malware binary that uses obfuscated control flow and encrypted strings. Dynamic analysis shows it creates a scheduled task, but you need to understand the full command line it uses. Which approach is most effective?

Run the strings utility on the binary to find the command line.

Disassemble the entire binary and manually trace all control flow paths.

Use a debugger to set a breakpoint on the scheduled task creation API and inspect the arguments at runtime.

Submit the binary to an online sandbox and read the scheduled task creation log.

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 3Objective 3

3.3 Apply the Concepts and Sequence of Steps in the Malware Analysis Process 350-201 Practice Questions (Page 4)

Part of the Processes domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 2–2 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

30%of the exam

Questions 16–20

16application · medium
An analyst is performing static analysis on a Windows executable and finds a suspicious string that appears to be a URL. The analyst wants to determine if the URL is a command-and-control endpoint. Which static analysis technique would be most helpful?
Select an answer first
17application · medium
You have a Linux malware sample. You need to identify its key logging behavior without executing it. Which static analysis technique is most likely to reveal this?
Select an answer first
18application · medium
A malware analyst is using a sandbox to analyze a sample that is known to check for the presence of analysis tools such as Wireshark and Process Monitor. The sandbox has these tools installed. What is the most likely outcome?
Select an answer first
19expert · hard
An analyst is investigating a malware infection and has a packet capture that includes multiple HTTP sessions, some of which are benign and some are malicious. The analyst needs to extract the malicious executable and confirm its behavior. The capture is large, and the analyst wants to minimize manual effort. Which approach is most efficient?
Select an answer first
20expert · hard
You are reverse engineering a malware binary that uses obfuscated control flow and encrypted strings. Dynamic analysis shows it creates a scheduled task, but you need to understand the full command line it uses. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.