What is the primary purpose of a malware analysis report?

To automatically block the malware on all systems

To provide a step-by-step guide for reverse engineering the malware

To communicate findings and indicators of compromise to stakeholders

To store the malware sample for future analysis

After analyzing a malware sample, an analyst must share the findings with the incident response team and management. Which two elements should be included in the report to ensure it is actionable for both audiences? (Select all that apply.)

A high-level summary of the malware's impact and recommended actions.

The full packet capture used during the analysis.

A detailed reverse engineering analysis of the malware's code.

A list of IOCs, such as file hashes and C2 domains.

An analyst ran a malware sample in a sandbox, but the sample only created a single file and made no network connections. What is the most likely reason to perform additional static analysis?

The sample is a known benign file

The sample may have been packed and only unpacked part of its code at runtime

The sandbox was not connected to the internet

The sample's hash is not in any threat intelligence database

During an incident response engagement, you capture network traffic and notice a workstation repeatedly contacting a suspicious IP address over HTTPS. You need to isolate the malware sample for further analysis. Which approach should you take?

Use a packet capture tool to extract the TLS-encrypted payload and save it as a binary file.

Use a network forensic tool to carve the executable from the TCP stream after decrypting with keys from the endpoint.

Perform static analysis on the packet capture file to identify the malware family.

Run the suspicious IP address through a sandbox to automatically download and execute the malware.

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 3Objective 3

3.3 Apply the Concepts and Sequence of Steps in the Malware Analysis Process 350-201 Practice Questions (Page 8)

Part of the Processes domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 2–2 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

30%of the exam

Questions 36–40

36foundation · easy
What is the primary purpose of a malware analysis report?
Select an answer first
37application · medium · select all that apply
After analyzing a malware sample, an analyst must share the findings with the incident response team and management. Which two elements should be included in the report to ensure it is actionable for both audiences? (Select all that apply.)
Select an answer first
38foundation · easy
An analyst ran a malware sample in a sandbox, but the sample only created a single file and made no network connections. What is the most likely reason to perform additional static analysis?
Select an answer first
39application · medium
During an incident response engagement, you capture network traffic and notice a workstation repeatedly contacting a suspicious IP address over HTTPS. You need to isolate the malware sample for further analysis. Which approach should you take?
Select an answer first
40foundation · easy
Which packet capture and analysis tool provides a graphical interface and the ability to follow TCP streams, making it useful for isolating malicious artifacts from network traffic?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.