Exam 200-201 topic 1 question 261 discussion

Actual exam question from Cisco's 200-201

Question #: 261
Topic #: 1

Refer to the exhibit. An employee received an email from an unknown sender with an attachment and reported it as a phishing attempt. An engineer uploaded the file to Cuckoo for further analysis. What should an engineer interpret from the provided Cuckoo report?

A. MD5 of the file was not identified as malicious.
B. Win32.polip.a.exe is an executable file and should be flagged as malicious.
C. The file is clean and does not represent a risk.
D. Cuckoo cleaned the malicious file and prepared it for usage.

Show Suggested Answer

Suggested Answer: B 🗳️

by cy_analyst at Oct. 13, 2022, 9:56 a.m.

Comments

Submit Cancel

drdecker100

10 months ago

Selected Answer: B

B. Win32.polip.a.exe is an executable file and should be flagged as malicious. The Cuckoo report provides information on the behavior of the file submitted for analysis, and the fact that it was identified as Win32.polip.a.exe indicates that it is an executable file and may pose a risk. The description of the file as "malicious" suggests that it may contain malicious code or perform unwanted actions. It is important to note that just because a file has a specific name or label, it does not necessarily mean it is definitely malicious. Further analysis and investigation would be necessary to fully assess the risk posed by the file. However, based on the information provided in the report, it is reasonable to flag the file as malicious and take appropriate action to protect the system and data.

upvoted 3 times

...

cy_analyst

1 year, 1 month ago

Selected Answer: B

B is correct --> https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus%3AWin32%2FPolip.A

upvoted 2 times

...