SY0-701 · Question #643
A security engineer needs to quickly identify a signature from a known malicious file. Which of the following analysis methods would the security engineer most likely use?
The correct answer is A. Static. Static analysis is correct because it examines a file's contents - including its hash, strings, headers, and byte patterns - without executing it, making it the fastest way to extract and compare a known malicious signature against threat intelligence databases. Sandbox (B) is…
Question
Options
- AStatic
- BSandbox
- CNetwork traffic
- DPackage monitoring
How the community answered
(23 responses)- A91% (21)
- C4% (1)
- D4% (1)
Explanation
Static analysis is correct because it examines a file's contents - including its hash, strings, headers, and byte patterns - without executing it, making it the fastest way to extract and compare a known malicious signature against threat intelligence databases.
Sandbox (B) is wrong because it requires actually running the file in an isolated environment to observe behavior, which takes more time and is better suited for uncovering unknown threats, not quickly matching a known signature.
Network traffic (C) is wrong because it monitors data in transit and would help identify malicious communication patterns, not extract a file's internal signature.
Package monitoring (D) is wrong because it focuses on software supply chain activity (e.g., watching for suspicious package installs), which is unrelated to identifying file signatures.
Memory tip: Think "static = still" - the file stays still (unexecuted) while you inspect it, just like a signature on paper doesn't need to be "activated" to be read and compared.
Topics
Community Discussion
No community discussion yet for this question.