CS0-003 Incident Response and Management Practice Question
An analyst is performing static analysis on a suspicious executable file. Which of the following would be MOST useful to identify potential malicious behavior without executing the file?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Analyzing the import table.
Static analysis involves examining the file without executing it. The import table shows which Windows API functions the executable uses, which can indicate capabilities such as network communication, file operations, or registry modifications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Running the file in a sandbox.
Why it's wrong here
Running the file in a sandbox observes runtime behavior such as process spawning and file writes, which by definition requires executing the sample, making it dynamic analysis rather than the static approach the question requires.
- ✗
Monitoring network connections during execution.
Why it's wrong here
Monitoring network connections requires running the sample, so it is dynamic analysis and directly contradicts the requirement to avoid execution. It is tempting because observing callbacks and C2 traffic is a legitimate detection method, and it would be correct if the analyst were permitted to detonate the file in a sandbox.
- ✓
Analyzing the import table.
Why this is correct
The import table lists external functions and libraries the executable calls, revealing capabilities such as network access, file manipulation, or process injection without running the code. This static inspection satisfies the no-execution constraint while exposing likely malicious behaviour.
- ✗
Checking the file's digital signature.
Why it's wrong here
Signature checking only confirms whether the binary is signed and whether that signature validates; it reveals nothing about the code's behaviour, so it cannot identify malicious functionality. It is tempting because signature verification is a genuine static technique, and it would be the right choice when the question asks whether a file is authentic or tampered with.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.