312-49v11 practice question 24 of 25

You are a cybersecurity analyst tasked with performing dynamic malware analysis on a suspicious file received by your organization. Your objective is…

You are a cybersecurity analyst tasked with performing dynamic malware analysis on a suspicious file received by your organization. Your objective is to understand the behavior of the malware by running it in a controlled environment and monitoring its actions without allowing it to propagate to the production network. As a cybersecurity analyst conducting dynamic malware analysis, what is a key aspect of designing the testing environment to ensure the safety of the production network?

Answer options

A: Implementing host integrity monitoring to track system changes caused by the malware. Correct answer

B: Disabling antivirus software to prevent interference with the malware's execution.

C: Running the malware on physical machines to minimize the risk of network propagation.

D: Using outdated operating systems to reduce compatibility issues with the malware.

Correct Answer:

A. Implementing host integrity monitoring to track system changes caused by the malware.

Explanation

The question is flawed as the most critical safety aspect—network isolation—is not an option. However, among the choices provided, host integrity monitoring (HIM) is the most relevant. While primarily an analysis technique, HIM tools (e.g., Sysmon, Regshot) monitor and log filesystem, registry, process, and network changes initiated by the malware. By observing these behaviors, including attempts to connect to external hosts or scan the local network, an analyst can detect and react to attempts to breach the isolated environment. This monitoring provides a layer of security through visibility, allowing for intervention before a potential breakout affects the production network.

Why Incorrect

B. Disabling antivirus is a common step to allow malware to run unhindered for analysis, but it is inherently a security-reducing action, not a safety measure.
C. Using physical machines does not guarantee safety; an improperly isolated physical machine is more dangerous than a properly isolated virtual one.
D. Using outdated operating systems is a technique to match a target environment but increases the sandbox's vulnerability and is not a safety design principle.

References

1. NIST Special Publication 800-83

Guide to Malware Incident Prevention and Handling for Desktops and Laptops (July 2005). Section 4.3

"Malware Analysis

" describes creating a controlled laboratory environment. It emphasizes network isolation as the primary safety control

but also discusses the need for monitoring tools to "record all the actions that the malware takes."

2. Sikorski

& Honig

A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press. Chapter 1

"Dynamic Analysis

" details the use of monitoring utilities like Process Monitor and Regshot to observe malware behavior

which is a form of host integrity monitoring. The book stresses that this occurs within a safe

isolated environment.

3. Ligh

M. H.

Case

Levy

& Walters

A. (2014). The Art of Memory Forensics: Detecting Malware and Threats in Windows

Linux

and Mac Memory. Wiley. While focused on memory

the book discusses dynamic analysis principles

including the necessity of monitoring system state changes (a core function of HIM) within a secure lab to understand malware impact.

Keep practicing

Take the free 312-49v11 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test