300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CybersecurityDemo

Question

Question Image

Refer to the exhibit. An engineer is reviewing a .LNK (shortcut) file recently received as an email attachment and blocked by email security as suspicious. What should the engineer do next?

A Delete the suspicious email with the attachment as the file is a shortcut extension and does not represent any threat.
B Upload the file to a virus checking engine to compare with well-known viruses as the file is a virus disguised as a legitimate extension.
C Quarantine the file within the endpoint antivirus solution as the file is a ransomware which will encrypt the documents of a victim.
D Open the file in a sandbox environment for further behavioral analysis as the file contains a malicious script that runs on execution.

Explanation

The shortcut invokes powershell.exe with noninteractive execution, an execution-policy bypass, and an obfuscated command payload, indicating that launching it executes potentially malicious PowerShell. A sandbox permits safe observation of the payload’s behavior without assuming a specific malware family or impact. PowerShell documents that Bypass blocks nothing and produces no warnings or prompts.

Learn more

300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CybersecurityDemo

AstroTutor

Notes

Readiness

QuestionQ23

Community Discussion