You have completed the analysis of a banking trojan. You need to share the findings with a mixed audience of executives, incident responders, and threat intelligence analysts. What is the most effective way to structure your report?

Publish the raw analysis logs and packet captures for stakeholders to review.

Verbally brief the executives and email the full report to all stakeholders.

Create an executive summary with business impact, a technical section with IOCs and analysis details, and a threat intelligence section with TTPs.

Provide a single technical report with all indicators of compromise and reverse engineering details.

After completing the analysis of a ransomware sample, an analyst must share the findings with the incident response team, management, and a threat intelligence sharing group. What is the most appropriate way to present the results?

Post the full analysis report on the company's internal wiki for all employees to access.

Provide a single technical report with all details, including reverse engineering notes and IOCs.

Create separate reports tailored to each audience: executive summary for management, technical details for IR, and IOCs for the sharing group.

Verbally brief the incident response team and send a short email to management with the malware's name.

An analyst is investigating a suspicious executable that was downloaded from a phishing site. The analyst has a packet capture of the download session and needs to extract the exact binary for further analysis. Which approach should the analyst take to reliably obtain the malware sample?

Use a hex editor to manually copy the raw payload from the capture file.

Use a packet capture tool to reassemble the TCP stream and export the HTTP response body as a file.

Run the executable directly from the packet capture in a sandbox to observe its behavior.

Search the packet capture for the file's MD5 hash to locate the sample.

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 3Objective 3

3.3 Apply the Concepts and Sequence of Steps in the Malware Analysis Process 350-201 Practice Questions (Page 7)

Part of the Processes domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 2–2 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

30%of the exam

Questions 31–35

31application · medium
You have completed the analysis of a banking trojan. You need to share the findings with a mixed audience of executives, incident responders, and threat intelligence analysts. What is the most effective way to structure your report?
Select an answer first
32foundation · easy
Which tool is commonly used to extract strings from a malware binary during static analysis?
Select an answer first
33application · medium
After completing the analysis of a ransomware sample, an analyst must share the findings with the incident response team, management, and a threat intelligence sharing group. What is the most appropriate way to present the results?
Select an answer first
34foundation · easy
During an incident response investigation, a security analyst needs to extract a suspicious executable that was transferred over the network. Which tool is specifically designed to extract files from packet captures for further malware analysis?
Select an answer first
35application · medium
An analyst is investigating a suspicious executable that was downloaded from a phishing site. The analyst has a packet capture of the download session and needs to extract the exact binary for further analysis. Which approach should the analyst take to reliably obtain the malware sample?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

3.3 Apply the Concepts and Sequence of Steps in the Malware Analysis Process 350-201 Practice Questions (Page 7)

Questions 31–35

You have completed the analysis of a banking trojan. You need to share the findings with a mixed audience of executives, incident responders, and threat intelligence analysts. What is the most effective way to structure your report?

Which tool is commonly used to extract strings from a malware binary during static analysis?

After completing the analysis of a ransomware sample, an analyst must share the findings with the incident response team, management, and a threat intelligence sharing group. What is the most appropriate way to present the results?

During an incident response investigation, a security analyst needs to extract a suspicious executable that was transferred over the network. Which tool is specifically designed to extract files from packet captures for further malware analysis?

An analyst is investigating a suspicious executable that was downloaded from a phishing site. The analyst has a packet capture of the download session and needs to extract the exact binary for further analysis. Which approach should the analyst take to reliably obtain the malware sample?

Keep studying — Processes