When analyzing suspicious files in a sandbox environment, a security analyst focuses on identifying and evaluating their behavior in a controlled setting to confirm potential malicious activity:
* Inspect processes (B): Observing the processes that the file spawns or injects into during execution helps identify malicious actions or privilege escalation. This is a crucial part of dynamic analysis in the sandbox environment.
* Inspect PE header (E): The PE (Portable Executable) header contains metadata about how the file will execute on Windows systems. It reveals details such as the entry point, libraries used, and whether the file is suspiciously crafted or packed, which can be strong indicators of malicious behavior.
The other options (A, C, D) are important in the broader forensic analysis, but within thesandbox dynamic analysis, focusing on process behavior and file execution headers is critical for determining how the file interacts with the system and whether it is indeed malicious.
Reference:CyberOps Technologies (CBRFIR) 300-215 study guide, Chapter: Understanding Malware Analysis, Dynamic Analysis of Malware, page 389-392.

The CreateFileW call opens \\.\pipe\net\NtControlPipe10 with both GENERIC_READ and GENERIC_WRITE access. The \\.\pipe\ namespace identifies a Windows named pipe, an interprocess- communication mechanism that allows processes to exchange data. The output therefore indicates process-to- process communication through a named pipe. Nothing in the artifact shows destination ports or repeated connection attempts, so it does not establish port scanning. CreateFileW is a Windows API used to open files, devices, and pipes; it is not a keylogger module. The hexadecimal value appears as an exit code associated with ExitProcess, not as a registry modification, eliminating option D. Analysts should correlate the pipe name with process ancestry and other sandbox events because malware commonly uses named pipes for coordination or command exchange. This maps to CBRFIR objective 2.3, evaluating malware-analysis output to identify host activity. Cisco CBRFIR v1.2 exam topics

During the initial phase of incident response, the two key actions are:
* Disconnecting the server (B) to contain the threat and prevent lateral movement or further exfiltration.
* Reviewing network logs (E) to understand the timeline and scope of the attack.
These are emphasized in the containment and detection stages of the incident response lifecycle outlined in NIST 800-61 and covered in the Cisco CyberOps training.
-

To prepare a post-incident report, thecauseof the incident (what enabled it) and theeffect(what damage was done) are the primary components analyzed first. This allows teams to understand vulnerabilities exploited and the consequences, forming the basis for corrective action.
The Cisco CyberOps guide recommends beginning withroot cause analysisfollowed by impact assessment to guide future prevention strategies.

Option C correlates the external intelligence with the observed authentication sequence and then tests what the account did after access. The IP-range match is an IOC because it connects the session to infrastructure associated with a malicious actor. Repeated failures, an off-hours success, and subsequent account behavior can form IOAs by showing credential guessing, account compromise, discovery, privilege misuse, or lateral movement. Internal logs should not be evaluated in isolation when relevant external intelligence is available.
A successful login after repeated failures increases rather than removes suspicion, and merely waiting for more attempts risks allowing an active compromise to continue. CBRFIR Incident Response Techniques objectives 3.2 and 3.9 require responders to correlate host and network data and interpret internal and external threat-intelligence feeds to determine IOCs and IOAs. The selected action performs both requirements directly. Cisco CBRFIR v1.2 exam topics