Exam 200-201 topic 1 question 253 discussion

Actual exam question from Cisco's 200-201

Question #: 253
Topic #: 1

Refer to the exhibit. An engineer is reviewing a Cuckoo report of a file. What must the engineer interpret from the report?

A. The file will monitor user activity and send the information to an outside source.
B. The file will Insert itself into an application and execute when the application is run.
C. The file will appear legitimate by evading signature-based detection.
D. The file will not execute its behavior in a sandbox environment to avoid detection.

Show Suggested Answer

Suggested Answer: D 🗳️

by Eng_ahmedyoussef at Oct. 7, 2022, 10:19 p.m.

Comments

Submit Cancel

SecurityGuy

9 months, 2 weeks ago

Selected Answer: D

vmdetect and anti_debug. Sandbox is usually done via VMs or isolated environment, these types of malware doesn't run when it detects those conditions.

upvoted 3 times

...

theodorrrr

1 year, 7 months ago

why D any explanation?

upvoted 1 times

weganos

1 year, 5 months ago

Because of the anti_dbg under Yara.

upvoted 4 times

...

Eng_ahmedyoussef

1 year, 8 months ago

D. The file will not execute its behavior in a sandbox environment to avoid detection.

upvoted 1 times

...