hardMultiple Choice
CS0-003 Practice Question: During a forensic investigation, an analyst finds…
During a forensic investigation, an analyst finds a suspicious registry key that runs a program at startup. What is the best way to determine if the program is malicious?
⚠ Common exam trap
The CS0-004 exam often tests the distinction between 'best first step' and 'thorough analysis'—candidates mistakenly choose sandbox execution (Option C) because it seems more comprehensive, but the exam prioritizes speed and safety via hash-based threat intelligence queries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compute the hash of the executable and query threat intelligence
Computing the hash of the executable and querying threat intelligence (e.g., VirusTotal, AlienVault OTX) provides a definitive, objective indicator of known maliciousness by comparing the file's cryptographic fingerprint against global threat databases. This is the fastest and most reliable method to determine if the program is malicious without risking execution or relying on circumstantial evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Search the startup folder for the file
Why it's wrong here
Searching only the startup folder is an unreliable method for identifying persistence or determining if a file is malicious. Modern malware frequently establishes persistence via registry run keys (such as Run or RunOnce), scheduled tasks, or WMI event subscriptions rather than the easily visible startup folder.
- ✓
Compute the hash of the executable and query threat intelligence
Why this is correct
Generating a cryptographic hash (such as SHA-256) of the suspicious file and querying threat intelligence databases allows the analyst to quickly identify known malware. This passive analysis technique is safe, efficient, and leverages global threat data without risking exposure or executing the payload.
- ✗
Execute the program in a sandbox and observe behavior
Why it's wrong here
While dynamic analysis in a sandbox is valuable, executing the program immediately is a higher-risk action that should be deferred. Advanced malware can detect virtualized environments, delay execution, or attempt hypervisor escapes, making initial passive analysis via hashing a safer first step.
- ✗
Check the file's last modified timestamp
Why it's wrong here
Relying on the file's last modified timestamp is ineffective because metadata is easily manipulated by attackers using timestomping techniques to blend in with legitimate system files. Furthermore, a timestamp alone provides no technical insight into the file's actual functionality or threat status.
Go deeper
Related to this question
Learn chapter
Threat Hunting Techniques and Hypothesis Development
Key term
Threat intelligence
Threat intelligence is evidence-based knowledge about existing or emerging cyber threats that helps organizations defend against attacks.
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
About these practice questions
One of 701 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.