CAS-003 · Question #312
Ann, a member of the finance department at a large corporation, has submitted a suspicious email she received to the information security team. The team was not expecting an email from Ann, and it…
The correct answer is B. Use a protocol analyzer on the air-gapped PC. When a malicious PDF containing an exploit is opened on an air-gapped PC, any embedded malware will attempt to initiate network connections-C2 beaconing, DNS lookups, or data exfiltration attempts. Running a protocol analyzer (packet sniffer) on the air-gapped PC captures all…
Question
Ann, a member of the finance department at a large corporation, has submitted a suspicious email she received to the information security team. The team was not expecting an email from Ann, and it contains a PDF file inside a ZIP compressed archive. The information security learn is not sure which files were opened. A security team member uses an air-gapped PC to open the ZIP and PDF, and it appears to be a social engineering attempt to deliver an exploit. Which of the following would provide greater insight on the potential impact of this attempted attack?
Options
- ARun an antivirus scan on the finance PC.
- BUse a protocol analyzer on the air-gapped PC.
- CPerform reverse engineering on the document.
- DAnalyze network logs for unusual traffic.
- ERun a baseline analyzer against the user's computer.
How the community answered
(41 responses)- A24% (10)
- B59% (24)
- C5% (2)
- D2% (1)
- E10% (4)
Explanation
When a malicious PDF containing an exploit is opened on an air-gapped PC, any embedded malware will attempt to initiate network connections-C2 beaconing, DNS lookups, or data exfiltration attempts. Running a protocol analyzer (packet sniffer) on the air-gapped PC captures all these network communication attempts in real time, even though they cannot succeed due to the network isolation. Analyzing this captured traffic reveals the exploit's intended behavior: what servers it tries to contact, what protocols it uses, and what data it attempts to send. This provides direct insight into the attack's potential impact. Antivirus (A) may detect known signatures but misses zero-day exploits. Reverse engineering (C) is deeper analysis but not listed as more immediately insightful in this context. Network logs (D) would not show activity from an air-gapped machine.
Topics
Community Discussion
No community discussion yet for this question.