SBT CJDE Practice Questions - Security Blue Team Certified Junior Detection Engineer Exam

Access More Questions

A YARA rule must match a file that contains the string 'MZ' at offset 0 AND has a PE section named '.text'. Which YARA condition correctly expresses this?

uint16(0) == 0x5A4D and pe.sections[0].name == ".text" "MZ" at 0 and pe.sections[0].name == ".text" uint16(0) == 0x4D5A and for any s in pe.sections: (s.name == ".text") uint16(0) == 0x5A4D and for any s in pe.sections: (s.name == ".text")

Correct Answer:

uint16(0) == 0x5A4D and for any s in pe.sections: (s.name == ".text")

Access more questions from this quiz

Continue to SBT CJDE Practice Questions - Security Blue Team Certified Junior Detection Engineer Exam for more practice questions and the full quiz experience.

Access More Questions