Exam Code : 300-215
Exam Name : Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)
Vendor Name :
"Cisco"
300-215 Dumps
300-215 Braindumps
300-215 Real Questions
300-215 Practice Test
300-215 Actual Questions
killexams.com
Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)
https://killexams.com/pass4sure/exam-detail/300-215
Question: 51 Section 1
Refer to the exhibit. Which determination should be made by a security analyst?
An email was sent with an attachment named "Grades.doc.exe".
An email was sent with an attachment named "Grades.doc".
An email was sent with an attachment named "Final Report.doc".
An email was sent with an attachment named "Final Report.doc.exe".
Question: 52 Section 1
A security team received reports of users receiving emails linked to external or unknown URLs that are non-returnable and non-deliverable. The ISP also reported a 500% increase in the amount of ingress and egress email traffic received. After detecting the problem, the security team moves to the recovery phase in their incident response plan. Which two actions should be taken in the recovery phase of this incident? (Choose two.)
verify the breadth of the attack
collect logs
request packet capture
remove vulnerabilities
scan hosts with updated signatures
An organization uses a Windows 7 workstation for access tracking in one of their physical data centers on which a guard documents entrance/exit activities of all personnel. A server shut down unexpectedly in this data center, and a security specialist is analyzing the case. Initial checks show that the previous two days of entrance/exit logs are missing, and the guard is confident that the logs were entered on the workstation. Where should the security specialist look next to continue investigating this case?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ProfileList
HKEY_CURRENT_USER\Software\Classes\Winlog
HKEY_LOCAL_MACHINES\SOFTWARE\Microsoft\WindowsNT\CurrentUser
https://www.sciencedirect.com/topics/computer-science/window-event-log
Question: 54 Section 1
An engineer received a report of a suspicious email from an employee. The employee had already opened the attachment, which was an empty Word document.
The engineer cannot identify any clear signs of compromise but while reviewing running processes, observes that PowerShell.exe was spawned by cmd.exe with a grandparent winword.exe process. What is the recommended action the engineer should take?
Upload the file signature to threat intelligence tools to determine if the file is malicious.
Monitor processes as this a standard behavior of Word macro embedded documents.
Contain the threat for further analysis as this is an indication of suspicious activity.
Investigate the sender of the email and communicate with the employee to determine the motives.
Question: 55 Section 1
An engineer is analyzing a ticket for an unexpected server shutdown and discovers that the web-server ran out of useable memory and crashed. Which data is needed for further investigation?
/var/log/access.log
/var/log/messages.log
/var/log/httpd/messages.log
/var/log/httpd/access.log
Question: 56 Section 1
Refer to the exhibit. An employee notices unexpected changes and setting modifications on their workstation and creates an incident ticket. A support specialist checks processes and services but does not identify anything suspicious. The ticket was escalated to an analyst who reviewed this event log and also discovered that the workstation had multiple large data dumps on network shares. What should be determined from this information?
data obfuscation
reconnaissance attack
brute-force attack
log tampering
Question: 57 Section 1
Refer to the exhibit. A company that uses only the Unix platform implemented an intrusion detection system. After the initial configuration, the
number of alerts is overwhelming, and an engineer needs to analyze and classify the alerts. The highest number of alerts were generated from the signature shown in the exhibit.
Which classification should the engineer assign to this event?
True Negative alert
False Negative alert
False Positive alert
True Positive alert
Question: 58 Section 1
Refer to the exhibit. After a cyber attack, an engineer is analyzing an alert that was missed on the intrusion detection system. The attack exploited a vulnerability in a business critical, web-based application and violated its availability. Which two migration techniques should the engineer recommend? (Choose two.)
encapsulation
NOP sled technique
address space randomization
heap-based security
data execution prevention
An organization recovered from a recent ransomware outbreak that resulted in significant business damage. Leadership requested a report that identifies the problems that triggered the incident and the security team's approach to address these problems to prevent a reoccurrence. Which components of the incident should an engineer analyze first for this report?
impact and flow
cause and effect
risk and RPN
motive and factors