Questão 39 — CompTIA SY0-701 CompTIA Security+ Certification Exam
An employee asks a security analyst to scan a suspicious email that contains a link to a file on a file-sharing site. The analyst determines that the file is safe after downloading and scanning the file with antivirus software. When the employee opens the file, their device is infected with ransomware. Which of the following steps should the analyst have taken?
- A. Review the file in a code editor.
- B. Monitor the file connections with netstat -ano.
- C. Execute the file in a sandbox.
- D. Retrieve the file hash and check with OSINT.
Resposta correta:
C
Explicação
Explanation: Correct answer: C. Execute the file in a sandbox. The best answer is C. Execute the file in a sandbox. Antivirus alone may miss new, obfuscated, or modified malware, including ransomware. A sandbox provides an isolated environment where the file can be safely executed and observed for malicious behavior such as: file encryption activity process spawning registry changes network callbacks persistence attempts
Quer todas as 907 questões por R$ 1,00?