3.7 Determine IOCs in a Sandbox Environment (includes Generating Complex Indicators) 350-201 Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is a typical outcome of correlating a sandbox-generated domain with threat intelligence?

   • AThe domain is identified as a known command-and-control server associated with a specific malware family
   • BThe sandbox report is deleted to protect privacy
   • CThe domain is converted to an IP address for easier analysis
   • DThe domain is automatically blocked in all firewalls
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A sandbox report shows a malware sample that communicates with a domain that is also used by a legitimate business application in the organization. The domain is not on any blocklist, but the malware's behavior is clearly malicious. What is the best way to handle this IOC?

   • AIgnore the domain because it is used by a legitimate application.
   • BUse the domain as a standalone IOC because the malware contacted it.
   • CBlock the domain in the firewall to prevent the malware from communicating.
   • DCreate a detection rule that combines the domain with the malware's specific behavior, such as the process path or registry changes.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary purpose of a sandbox environment in malware analysis?

   • ATo compile malware source code into an executable for further analysis
   • BTo permanently delete malicious files from the system
   • CTo provide a public server for hosting malware samples for research sharing
   • DTo execute suspicious code in an isolated environment to observe its behavior without risking the production network
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A sandbox report shows a sample that communicates with an IP address that is flagged as malicious by one threat intelligence feed but not by another. The sample also creates a unique file named 'sysupdate.log'. The analyst needs to decide whether to include the IP address as an IOC. What is the best course of action?

   • AInclude the IP address because at least one feed flags it as malicious
   • BExclude the IP address because not all feeds agree
   • CCorrelate the IP address with the file hash and other sandbox behaviors to determine if it is part of the malware's activity
   • DUse only the file name 'sysupdate.log' as an IOC
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst needs to analyze a suspicious email attachment that is a macro-enabled Excel file. The analyst wants to observe the macro's behavior without risking the corporate network. What is the best approach?

   • AUpload the file to a public online sandbox service without any restrictions.
   • BDisable macros and open the file in a text editor to view the code.
   • CRun the file in an isolated sandbox with network simulation and monitor for process, file, and network activity.
   • DOpen the file on a corporate workstation with macros enabled.
   Reveal Solution Discussion Select an answer first