nerdexam
Cisco

200-201 · Question #279

Refer to the exhibit. A SOC engineer is analyzing the provided Cuckoo Sandbox report for a file that has been downloaded from an URL, received via email. What is the state of this file?

The correct answer is A. The file was identified as PE32 executable for MS Windows and the Yara filed lists it as Trojan.. The Cuckoo Sandbox report identifies the downloaded file as a PE32 executable for MS Windows and classifies it as a Trojan based on Yara rules.

Submitted by yaw92· Mar 6, 2026Host-Based Analysis

Question

Refer to the exhibit. A SOC engineer is analyzing the provided Cuckoo Sandbox report for a file that has been downloaded from an URL, received via email. What is the state of this file?

Exhibit

200-201 question #279 exhibit

Options

  • AThe file was identified as PE32 executable for MS Windows and the Yara filed lists it as Trojan.
  • BThe file was detected as executable and was matched by PEiD threat signatures for further
  • CThe file was detected as executable, but no suspicious features are identified.
  • DThe calculated SHA256 hash of the file was matched and identified as malicious.

How the community answered

(59 responses)
  • A
    71% (42)
  • B
    3% (2)
  • C
    17% (10)
  • D
    8% (5)

Why each option

The Cuckoo Sandbox report identifies the downloaded file as a PE32 executable for MS Windows and classifies it as a Trojan based on Yara rules.

AThe file was identified as PE32 executable for MS Windows and the Yara filed lists it as Trojan.Correct

The Cuckoo Sandbox report's 'File Type' field explicitly states 'PE32 executable for MS Windows', and the 'Yara Rules' section lists 'Trojan', directly confirming both aspects of the file's state.

BThe file was detected as executable and was matched by PEiD threat signatures for further

While PEiD is mentioned in the report, the statement does not fully capture the explicit 'Trojan' classification by Yara rules, making option A more comprehensive and accurate.

CThe file was detected as executable, but no suspicious features are identified.

The report clearly identifies 'Yara Rules: Trojan', which indicates suspicious features are identified, contradicting the claim that no suspicious features exist.

DThe calculated SHA256 hash of the file was matched and identified as malicious.

Although the SHA256 hash is provided, the report's immediate classification of 'Trojan' is based on Yara rules and file type analysis, not solely on a hash match identified as malicious in the provided snippet.

Concept tested: Cuckoo Sandbox report analysis, malware identification

Source: https://cuckoo.sh/docs/introduction/index.html

Topics

#Cuckoo Sandbox#Malware analysis#YARA rules#Threat intelligence

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 200-201 Practice