Question

Ann, a member of the finance department at a large corporation, has submitted a suspicious email she received to the information security team. The team was not expecting an email from Ann, and it contains a PDF file inside a ZIP compressed archive. The information security team is not sure which files were opened. A security team member uses an air-gapped PC to open the ZIP and PDF, and it appears to be a social engineering attempt to deliver an exploit.

Which of the following would provide greater insight on the potential impact of this attempted attack?

A. Run an antivirus scan on the finance PC.
B. Use a protocol analyzer on the air-gapped PC.
C. Perform reverse engineering on the document.
D. Analyze network logs for unusual traffic.
E. Run a baseline analyzer against the user's computer.

Answer 1

To investigate the suspicious email's impact, the security team should perform reverse engineering on the document and analyze network logs.

Step-by-step explanation:

To gain greater insight on the potential impact of the suspicious email and included PDF file sent to Ann from the finance department, the most effective steps would be to both perform reverse engineering on the PDF document (option C) and to analyze network logs (option D) for any unusual traffic.

Reverse engineering the document can reveal the presence of any potential exploits embedded in the PDF, providing insight into what the exploit is designed to do and how it might affect the system should it be executed. Meanwhile, analyzing network logs could indicate if any data was exfiltrated or if the computer communicated with any known malicious servers, helping to determine if the attack was successful and the scope of the impact.

Running an antivirus scan (option A) could also help but might not detect a sophisticated attack, while a protocol analyzer on the air-gapped PC (option B) wouldn't provide information about the impact on the corporate network since the test PC is isolated. Lastly, running a baseline analyzer against the user's computer (option E) would help ascertain any changes made to the system settings or installed applications but wouldn't provide insights into what the malware was designed to do.