nerdexam
Cisco

200-201 · Question #262

Refer to the exhibit. An engineer is reviewing a Cuckoo report of a file. What must the engineer interpret from the report?

The correct answer is B. The file will not execute its behavior in a sandbox environment to avoid detection.. This Cuckoo report indicates that the analyzed file employs sandbox evasion techniques, preventing its malicious behavior from being fully observed within the sandboxed environment.

Submitted by stefanr· Mar 6, 2026Host-Based Analysis

Question

Refer to the exhibit. An engineer is reviewing a Cuckoo report of a file. What must the engineer interpret from the report?

Exhibit

200-201 question #262 exhibit

Options

  • AThe file will appear legitimate by evading signature-based detection.
  • BThe file will not execute its behavior in a sandbox environment to avoid detection.
  • CThe file will insert itself into an application and execute when the application is run.
  • DThe file will monitor user activity and send the information to an outside source.

How the community answered

(66 responses)
  • A
    18% (12)
  • B
    70% (46)
  • C
    8% (5)
  • D
    5% (3)

Why each option

This Cuckoo report indicates that the analyzed file employs sandbox evasion techniques, preventing its malicious behavior from being fully observed within the sandboxed environment.

AThe file will appear legitimate by evading signature-based detection.

While malware can evade signature-based detection, the Cuckoo report is primarily focused on dynamic and behavioral analysis, not specifically signature evasion, and a lack of observed malicious behavior often points to evasion.

BThe file will not execute its behavior in a sandbox environment to avoid detection.Correct

Malware often includes code to detect if it's running in a virtualized or sandbox environment. If detected, it may intentionally not execute its full malicious payload or exhibit benign behavior to evade analysis and detection by security tools. This behavior is designed to prevent security analysts from understanding its true function during dynamic analysis.

CThe file will insert itself into an application and execute when the application is run.
DThe file will monitor user activity and send the information to an outside source.

Concept tested: Malware sandbox evasion techniques

Source: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/detect-sandbox-evasion?view=o365-worldwide

Topics

#malware analysis#sandbox analysis#Cuckoo Sandbox#evasion techniques

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 200-201 Practice