A security team receives reports of multiple files causing suspicious activity on users' workstations. The file attempted to access highly confidential information in a centralized file server…

The correct answer is B. Inspect processes. E. Inspect PE header. When analyzing suspicious files in a sandbox environment, a security analyst focuses on identifying and evaluating their behavior in a controlled setting to confirm potential malicious Inspect processes (B): Observing the processes that the file spawns or injects into during…

Submitted by paula_co· Mar 6, 2026Forensics Techniques

Question

A security team receives reports of multiple files causing suspicious activity on users' workstations. The file attempted to access highly confidential information in a centralized file server. Which two actions should be taken by a security analyst to evaluate the file in a sandbox? (Choose two.)

Options

AInspect registry entries
BInspect processes.
CInspect file hash.
DInspect file type.
EInspect PE header.

How the community answered

(65 responses)

A
8% (5)
B
71% (46)
C
5% (3)
D
17% (11)

Explanation

When analyzing suspicious files in a sandbox environment, a security analyst focuses on identifying and evaluating their behavior in a controlled setting to confirm potential malicious Inspect processes (B): Observing the processes that the file spawns or injects into during execution helps identify malicious actions or privilege escalation. This is a crucial part of dynamic analysis in the sandbox environment. Inspect PE header (E): The PE (Portable Executable) header contains metadata about how the file will execute on Windows systems. It reveals details such as the entry point, libraries used, and whether the file is suspiciously crafted or packed, which can be strong indicators of malicious

Topics

#malware analysis#sandbox analysis#dynamic analysis#file analysis

Community Discussion

No community discussion yet for this question.

Full 300-215 Practice