Câu 27: 300-215: Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

A security team receives reports of multiple files causing suspicious activity on users' workstations. The file attempted to access highly confidential information in a centralized file server. Which two actions should be taken by a security analyst to evaluate the file in a sandbox? (Choose two.)

1. A. Inspect registry entries
2. B. Inspect processes. — đáp án hiện tại
3. C. Inspect file hash. — đáp án hiện tại
4. D. Inspect file type.
5. E. Inspect PE header.