A scanner detected a malware-infected file on an endpoint that is attempting to beacon to an external site. An analyst has reviewed the IPS and SIEM logs but is unable to identify the file's…

The correct answer is C. Antivirus solution. If IPS and SIEM logs do not give enough insight into a file's behavior, the next logical step is to review the Antivirus solution logs. These logs often provide detailed behavior analytics such as: - File actions and access patterns - Registry modifications - File execution…

Submitted by cyberguy42· Mar 6, 2026Incident Response Techniques

Question

A scanner detected a malware-infected file on an endpoint that is attempting to beacon to an external site. An analyst has reviewed the IPS and SIEM logs but is unable to identify the file's behavior. Which logs should be reviewed next to evaluate this file further?

Options

Aemail security appliance
BDNS server
CAntivirus solution
Dnetwork device

How the community answered

(51 responses)

A
6% (3)
B
4% (2)
C
78% (40)
D
12% (6)

Explanation

If IPS and SIEM logs do not give enough insight into a file's behavior, the next logical step is to review the Antivirus solution logs. These logs often provide detailed behavior analytics such as: - File actions and access patterns - Registry modifications - File execution history The Cisco CyberOps guide emphasizes AV logs as critical forensic artifacts for understanding endpoint-based infections, especially when beaconing or suspicious activity is suspected.

Topics

#malware investigation#log analysis#endpoint security#beaconing

Community Discussion

No community discussion yet for this question.

Full 300-215 Practice