Pre-Summer Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: xmas50

Cisco 300-215 - Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

Cisco 300-215 Premium Access     Download Demo    
Page: 4 / 4
Total 131 questions

Rotor to the exhibit.

A cybersecurity analyst must analyst the logs from an Apache server for the client. The concern is that an offboarded employee home IP address was potentially used to access the company web server via a still active VPN connection Based on this log entry, what should an analyst conclude?

A.

An ex employee planted malware on the server

B.

A file was downloaded from the server

C.

A worker uploaded a file to the server

D.

An employee has accessed a web page on the server

Refer to the exhibit.

Which two determinations should be made about the attack from the Apache access logs? (Choose two.)

A.

The attacker used r57 exploit to elevate their privilege.

B.

The attacker uploaded the WordPress file manager trojan.

C.

The attacker performed a brute force attack against WordPress and used SQL injection against the backend database.

D.

The attacker used the WordPress file manager plugin to upload r57.php.

E.

The attacker logged on normally to WordPress admin page.

An attacker modifies a malicious file named TOPSECRET0523619132 by changing its file extension from a .png to a doc in an attempt to evade detection. Which technique is being used to disguise the file?

A.

steganography

B.

obfuscatiofi

C.

spoofing

D.

hashing

Refer to the exhibit.

An engineer is analyzing a TCP stream in Wireshark after a suspicious email with a URL. What should be determined about the SMB traffic from this stream?

A.

It is redirecting to a malicious phishing website

B.

It is exploiting redirect vulnerability

C.

It is requesting authentication on the user site.

D.

It is sharing access to files and printers.

A cybersecurity analyst detects fileless malware activity on secure endpoints. What should be done next?

A.

Immediately quarantine the endpoints containing the suspicious files and consider the issue resolved

B.

Isolate the affected endpoints and conduct a detailed memory analysis to identify fileless malware execution.

C.

Delete the suspicious files and monitor the endpoints for any further signs of compromise.

D.

Share the findings with other government agencies for collaborative threat analysis and response.

The Linux system administrator of a company suspects that physical unauthorized access was granted to a local Linux terminal. The administrator wants to examine the suspected machine for potential unauthorized use and to get information about even/ account in this terminal including when the password last changed The administrator logs in as a root user Which file should be examined to get the information?

A.

/etc/users

B.

/etc/auth

C.

/etc/shadow

D.

/etc/passwd

During a routine inspection of system logs, a security analyst notices an entry where Microsoft Word initiated a PowerShell command with encoded arguments. Given that the user's role does not involve scripting or advanced document processing, which action should the analyst take to analyze this output for potential indicators of compromise?

A.

Monitor the Microsoft Word startup times to ensure they align with business hours.

B.

Confirm that the Microsoft Word license is valid and the application is updated to the latest version.

C.

Validate the frequency of PowerShell usage across all hosts to establish a baseline.

D.

Review the encoded PowerShell arguments to decode and determine the intent of the script.

A network host is infected with malware by an attacker who uses the host to make calls for files and shuttle traffic to bots. This attack went undetected and resulted in a significant loss. The organization wants to ensure this does not happen in the future and needs a security solution that will generate alerts when command and control communication from an infected device is detected. Which network security solution should be recommended?

A.

Cisco Secure Firewall ASA

B.

Cisco Secure Firewall Threat Defense (Firepower)

C.

Cisco Secure Email Gateway (ESA)

D.

Cisco Secure Web Appliance (WSA)

Drag and drop the capabilities on the left onto the Cisco security solutions on the right.