2.6 Compare and Contrast WildFire, Unit 42 Intelligence, and VirusTotal SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 8)

Questions 36–36

1. 36application · medium

   A security analyst is using VirusTotal to investigate a suspicious file. The file is detected by a single antivirus engine as 'Trojan.GenericKD.3356789'. The analyst knows this detection name is commonly associated with a heuristic detection. What is the most appropriate next step for the analyst to take?

   • AIgnore the detection because heuristic detections are always false positives.
   • BPerform additional analysis, such as checking the file's behavior in a sandbox or reviewing its metadata and code.
   • CTreat the file as malicious and immediately quarantine it on all systems.
   • DTreat the file as benign because only one engine detected it.
   Reveal Solution Discussion Select an answer first