CAS-003 · Question #429
An organization's Chief Financial Officer (CFO) was the target of several different social engineering attacks recently. The CFO has subsequently worked closely with the Chief Information Security…
The correct answer is A. Place it in a malware sandbox. A malware sandbox is an isolated, instrumented environment where a suspicious file can be executed safely. The sandbox monitors all behavior - file system changes, registry modifications, network calls, process spawning - without any risk to the real system. This is the…
Question
An organization's Chief Financial Officer (CFO) was the target of several different social engineering attacks recently. The CFO has subsequently worked closely with the Chief Information Security Officer (CISO) to increase awareness of what attacks may look like. An unexpected email arrives in the CFO's inbox from a familiar name with an attachment. Which of the following should the CISO task a security analyst with to determine whether or not the attachment is safe?
Options
- APlace it in a malware sandbox.
- BPerform a code review of the attachment.
- CConduct a memory dump of the CFO's PC.
- DRun a vulnerability scan on the email server.
How the community answered
(49 responses)- A92% (45)
- B4% (2)
- C2% (1)
- D2% (1)
Explanation
A malware sandbox is an isolated, instrumented environment where a suspicious file can be executed safely. The sandbox monitors all behavior - file system changes, registry modifications, network calls, process spawning - without any risk to the real system. This is the standard first-line analysis technique for unknown attachments, especially in a targeted social engineering context. A code review (B) is impractical for binary executables and not efficient. A memory dump (C) would only be useful after an infection has already occurred. A vulnerability scan of the email server (D) tests server weaknesses, not the attachment's content.
Topics
Community Discussion
No community discussion yet for this question.