FCP-FSA-AD-5-0: Fortinet NSE 5 - FortiSandbox 5.0 Administrator

By Fortinet · Question Mode

QuestionQ18

VerifiedSecurity Management

A recently downloaded file on several end stations is displaying malware behavior, but the sandbox rates the file as clean. Further investigation shows that only end stations using the Opera browser are affected.

What must you do to prevent these infections?

Explanation

Browser-specific malware can evade detection when the sandbox VM does not reproduce the affected browser environment. Using a custom VM with the same browser as the exploited end stations allows the file to execute under the relevant conditions so FortiSandbox can observe and rate its malicious behavior. FortiSandbox supports custom VMs and browser configuration for VM-based analysis.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!