Câu 24: 300-215: Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

Refer to the exhibit. An engineer is analyzing a .LNK (shortcut) file recently received as an email attachment and blocked by email security as suspicious. What is the next step an engineer should take?

1. A. Delete the suspicious email with the attachment as the file is a shortcut extension and does not represent any threat.
2. B. Upload the file to a virus checking engine to compare with well-known viruses as the file is a virus disguised as a legitimate extension.
3. C. Quarantine the file within the endpoint antivirus solution as the file is a ransomware which will encrypt the documents of a victim.
4. D. Open the file in a sandbox environment for further behavioral analysis as the file contains a malicious script that runs on execution. — đáp án hiện tại