300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CybersecurityDemo

By Cisco · Question Mode

QuestionQ75

Forensics Techniques

A cybersecurity analyst at a software development company discovers a group of files with an unusual .xyz extension that suddenly appeared in the network’s shared storage. The files have no known connection to the company’s active projects and are unusually large. An initial scan detects no known malware signatures. Which action should be taken next to assess the files based on these distinguishing characteristics?

  • A Isolate the files and perform a deeper heuristic analysis to detect potential unknown malware or data exfiltration payloads.
  • B Rename the file extensions to .txt to enable easier opening and review by team members.
  • C Delete the files immediately to prevent potential risks, given the unknown nature and lack of relevance to current projects.
  • D Move the files to a less secure network segment for further analysis, to reduce the load on the main network.
Explanation

Files that are unexpected, unusually large, and unrelated to authorized work warrant containment and deeper analysis. Heuristic analysis can identify suspicious behavior, novel malware, obfuscation, or possible data-exfiltration payloads that signature-based scanning may not detect, while isolation limits exposure and preserves evidence.

Community Discussion

No comments yet. Be the first to start the discussion!