Which two actions should be taken by a security analyst to evaluate the file in a sandbox?

A security team receives reports of multiple files causing suspicious activity on users’ workstations. The file attempted to access highly confidential information in a centralized file server.

Which two actions should be taken by a security analyst to evaluate the file in a sandbox? (Choose two.)
A . Inspect registry entries
B . Inspect processes.
C . Inspect file hash.
D . Inspect file type.
E . Inspect PE header.

View Answer

Answer: BC

Explanation:

Reference: https://medium.com/@Flying_glasses/top-5-ways-to-detect-malicious-file-manually­d02744f7c43a