Refer to the exhibit. An engineer is analyzing this Cuckoo Sandbox report for a PDF file that has been downloaded from an email. What is the state of this file?

• A. The file has an embedded executable and was matched by PEiD threat signatures for further analysis.
• B. The file has an embedded non-Windows executable but no suspicious features are identified.
• C. The file was matched by PEiD threat signatures but no suspicious features are identified since the signature list is up to date.
• D. The file has an embedded Windows 32 executable and the Yara field lists suspicious features for further analysis.

What describes the usage of a rootkit in endpoint-based attacks?

• A. set of tools used by an attacker to maintain control of a compromised system while avoiding detection
• B. remote code execution that causes a denial-of-service on the system
• C. exploit that can be used to perform remote code execution
• D. set of vulnerabilities used by an attacker to disable root access on the system

Which utility blocks a host portscan?

• A. host-based firewall
• B. sandboxing
• C. antimalware
• D. HIDS

What is the impact of false positive alerts on business compared to true positive?

• A. True positives affect security as no alarm is raised when an attack has taken place, while false positives are alerts raised appropriately to detect and further mitigate them.
• B. True-positive alerts are blocked by mistake as potential attacks, while False-positives are actual attacks Identified as harmless.
• C. False positives alerts are manually ignored signatures to avoid warnings that are already acknowledged, while true positives are warnings that are not yet acknowledged.
• D. False-positive alerts are detected by confusion as potential attacks, while true positives are attack attempts identified appropriately.