5.2 Detect, Analyze, and Mitigate Malware Incidents CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security analyst receives an email with an attachment that is suspected to be malware. The analyst wants to safely analyze the attachment without risking the corporate network. Which method should the analyst use?

   • ASubmit the attachment to a sandboxing service that detonates it in an isolated environment
   • BRun the attachment on a spare laptop that is not connected to the corporate network
   • CUse a hex editor to examine the file's contents without executing it
   • DOpen the attachment on a non-networked virtual machine
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   During a malware incident, the incident response team has identified several indicators of compromise (IOCs) including file hashes, domains, and IP addresses. The team wants to determine if other hosts in the environment are affected. What is the most efficient way to search for these IOCs across the enterprise?

   • AUse the threat intelligence platform to correlate the IOCs with existing security logs
   • BManually check each host for the file hashes
   • CDeploy a new signature to the antivirus to detect the file hashes
   • DReview firewall logs for connections to the malicious IP addresses
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   After containing a malware incident, the incident response team is preparing a post-incident report. What should be included in the report to ensure lessons learned are captured for future prevention?

   • AA detailed timeline of the incident, actions taken, and recommendations for improvement
   • BA list of employees who were affected by the incident
   • CThe cost of the incident in terms of lost productivity
   • DOnly the technical details of the malware and IOCs
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security analyst is investigating a suspicious file that was downloaded from the internet. The file is not detected by signature-based antivirus, but the analyst suspects it may be malicious. Which detection technique would be most effective in identifying this unknown malware?

   • AReputation-based detection by checking the file's hash against a threat intelligence feed
   • BSignature-based detection using the latest antivirus definitions
   • CHeuristic analysis that examines the file's code structure and behavior patterns
   • DBehavioral analysis by running the file in a sandbox and monitoring its actions
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst at a financial firm notices that an employee received an email with a link to a file-sharing site. The link is not on any blocklist, but the domain was registered 48 hours ago. The analyst must determine if the file is malicious without risking the corporate network. Which approach best balances safety and speed?

   • AInspect the file's strings and imports using a hex editor.
   • BRun a signature-based scan on the file using the latest antivirus definitions.
   • CDetonate the file in a sandbox with network simulation and monitor for suspicious behavior.
   • DBlock the domain at the firewall based on its recent registration.
   Reveal Solution Discussion Select an answer first