300-215 · Question #82
A cybersecurity analyst must evaluate files from endpoints and conduct ad-hoc scans in a highly secure government agency: During the analysis, the analyst identifies a set of suspicious files on…
The correct answer is B. Isolate the affected endpoints and conduct a detailed memory analysis to identify fileless malware. Fileless malware resides in memory and does not leave traditional file artifacts, making it difficult for antivirus solutions to detect. The most effective next step is to isolate the endpoints to prevent lateral movement and perform memory forensics to capture volatile data…
Question
A cybersecurity analyst must evaluate files from endpoints and conduct ad-hoc scans in a highly secure government agency: During the analysis, the analyst identifies a set of suspicious files on multiple endpoints. These files exhibit unusual behavior, such as evading traditional antivirus scans and employing fileless malware techniques. In this technically challenging scenario, what should the cybersecurity analyst recommend as the next step in the process of evaluating these suspicious files and performing ad-hoc scans to ensure the highest level of security?
Options
- AImmediately quarantine the endpoints containing the suspicious files and consider the issue
- BIsolate the affected endpoints and conduct a detailed memory analysis to identify fileless malware
- CDelete the suspicious files and monitor the endpoints for any further signs of compromise.
- DShare the findings with other government agencies for collaborative threat analysis and response.
How the community answered
(21 responses)- A5% (1)
- B62% (13)
- C24% (5)
- D10% (2)
Explanation
Fileless malware resides in memory and does not leave traditional file artifacts, making it difficult for antivirus solutions to detect. The most effective next step is to isolate the endpoints to prevent lateral movement and perform memory forensics to capture volatile data and identify any running malicious processes.
Topics
Community Discussion
No community discussion yet for this question.