3.7 Determine IOCs in a Sandbox Environment (includes Generating Complex Indicators) 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   After analyzing a ransomware sample in a sandbox, the report shows the sample encrypts files with a specific extension, drops a ransom note named 'README.txt', and attempts to connect to an IP address that is listed in the organization's threat intelligence feed as a known C2 server. Which set of IOCs should the analyst prioritize for immediate blocking?

   • AThe sample's SHA-256 hash and the file extension used for encryption
   • BThe ransom note filename and the C2 IP address
   • CThe file extension used for encrypted files and the ransom note filename
   • DThe C2 IP address and the sample's SHA-256 hash
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In a sandbox report, which of the following would be considered an IOC?

   • AThe version of the virtualization software used
   • BThe name of the sandbox's host operating system
   • CThe total number of files in the sandbox's operating system
   • DA registry key modification that creates a persistence mechanism
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is an example of a network connection that a sandbox would record during dynamic analysis?

   • AThe MAC address of the local network adapter
   • BThe amount of RAM allocated to the virtual machine
   • CAn outbound TCP connection to a remote IP address on port 443
   • DThe version of the operating system kernel
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Why is it beneficial to correlate sandbox outputs with threat intelligence?

   • ATo change the malware's behavior to be more detectable
   • BTo validate whether the observed indicators are known malicious and to enrich them with additional context
   • CTo automatically delete the analyzed file from the sandbox
   • DTo increase the speed of the sandbox execution
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which characteristic is essential for a sandbox environment used in malware analysis?

   • AShared storage with production servers for easy file access
   • BIsolation from the production network to prevent malware propagation
   • CHigh-performance graphics processing for rendering malware animations
   • DDirect connection to the internet to allow malware to download additional payloads
   Reveal Solution Discussion Select an answer first