MENU
A security team receives reports of multiple files causing suspicious activity on users' workstations. The file attempted to access highly confidential information in a centralized file server. Which two actions should be taken by a security analyst to evaluate the file in a sandbox? (Choose two.)
Suggested Answer: B, C
Get Premium 300-215 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
8 comments · newest first
LE
Leota
12 months ago
Registry entries can be useful, but not the priority.
CH
Charlie
12 months ago
Surprised that PE header isn't a top choice here!
AV
Avery
1 year ago
I thought inspecting file type was more important?
TR
Tresa
1 year ago
Inspecting processes is a must too!
BA
Barabara
1 year ago
Definitely check the file hash first.
KI
Kimberlie
1 year ago
Okay, let's see here. I'm pretty sure the "Delete Item" and "Apply System Configuration" tasks would need the plug-in, but I'm not sure about the others.
IN
Inocencia
1 year ago
I'm a little unsure about this one. The code snippets don't seem to directly show the "Account deleted" alert, so I'm not sure how to approach it. Maybe I'd try running the code and seeing where the alert is displayed, then tracing back to the relevant lines of code.
CE
Cecil
1 year ago
I'm not so sure though. The use of proprietary protocols could also create vulnerabilities, right? It's hard to say which is the greatest risk.