Amid a critical cybersecurity incident, a multinational corporation has a suspected breach involving an advanced and evasive strain of malware. The cybersecurity team is under immense pressure to…

Question

Options

• ABegin with dynamic analysis to observe real-time behavior, followed by static analysis to dissect the malware's code.
• BPrioritize static analysis to gain a deep understanding of the malware's code structure, then execute the malware in a controlled environment for behavioral observation, and conclude with network traffic analysis to assess its impact on network infrastructure.
• CStart with network traffic analysis to rapidly identify command and control servers, comprehensively understand communication patterns, and assess the malware's impact on network infrastructure. Subsequently, perform behavioral analysis by executing the malware in a controlled environment, and conclude with static analysis to dissect the malware's code structure.
• DInitiate the analysis by executing the malware in a controlled environment for behavioral observation, followed by network traffic analysis to identify command and control servers, and conclude with static analysis to examine the code for vulnerabilities.

• A
  7% (3)
• B
  9% (4)
• C
  67% (31)
• D
  17% (8)

Explanation

Option C is correct because in a critical, time-sensitive incident, network traffic analysis provides the fastest actionable intelligence - identifying command-and-control (C2) servers immediately allows the team to block communications and contain damage before deeper investigation begins. Behavioral analysis in a controlled environment follows naturally, revealing how the malware executes without exposing production systems. Static code analysis is saved for last, since it is the most time-intensive phase and is better informed by behavioral and network findings already gathered.

Option A inverts the priority: observing runtime behavior before understanding network impact delays containment of C2 communications and omits network analysis entirely. Option B front-loads static analysis - the slowest and most resource-intensive phase - creating unacceptable delay in a live incident where every minute of active C2 communication increases damage. Option D begins by executing the malware before performing network traffic analysis, meaning C2 servers remain unidentified and potentially active on the real network while behavioral observation is underway, compounding risk.

Memory tip: Think of the sequence as moving from "what is it doing right now?" (network) → "what does it do?" (behavior) → "what is it?" (static code). In an emergency, you triage what's actively harming you first - just like a doctor checks vitals before ordering a full lab workup.

No community discussion yet for this question.