Cisco CyberOps Professional 300-215 Questions & Answers

• Question 21:

  

  Refer to the exhibit. Which two actions should be taken as a result of this information? (Choose two.)

  A. Update the AV to block any file with hash "cf2b3ad32a8a4cfb05e9dfc45875bd70".

  B. Block all emails sent from an @state.gov address.

  C. Block all emails with pdf attachments.

  D. Block emails sent from [email protected] with an attached pdf file with md5 hash "cf2b3ad32a8a4cfb05e9dfc45875bd70".

  E. Block all emails with subject containing "cf2b3ad32a8a4cfb05e9dfc45875bd70".

  Correct Answer: AB

• Question 22:

  Which information is provided bout the object file by the "-h" option in the objdump line command objdump 璪 oasys 璵 vax 環 fu.o?

  A. bfdname

  B. debugging

  C. help

  D. headers

  Correct Answer: D

  Reference: https://sourceware.org/binutils/docs/binutils/objdump.html

• Question 23:

  A threat actor attempts to avoid detection by turning data into a code that shifts numbers to the right four times. Which anti-forensics technique is being used?

  A. encryption

  B. tunneling

  C. obfuscation

  D. poisoning

  Correct Answer: C

  Reference: https://www.vadesecure.com/en/malware-analysis-understanding-code-obfuscation-techniques/#:~:text=Obfuscation%20of%20character%20strings%20is,data%20when%20the%20code%20executes.

• Question 24:

  Which technique is used to evade detection from security products by executing arbitrary code in the address space of a separate live operation?

  A. process injection

  B. privilege escalation

  C. GPO modification

  D. token manipulation

  Correct Answer: A

  Reference: https://attack.mitre.org/techniques/T1055/

• Question 25:

  

  Refer to the exhibit. An HR department submitted a ticket to the IT helpdesk indicating slow performance on an internal share server. The helpdesk engineer checked the server with a real-time monitoring tool and did not notice anything suspicious. After checking the event logs, the engineer noticed an event that occurred 48 hour prior. Which two indicators of compromise should be determined from this information? (Choose two.)

  A. unauthorized system modification

  B. privilege escalation

  C. denial of service attack

  D. compromised root access

  E. malware outbreak

  Correct Answer: AD

• Question 26:

  An attacker embedded a macro within a word processing file opened by a user in an organization's legal department. The attacker used this technique to gain access to confidential financial data. Which two recommendations should a security expert make to mitigate this type of attack? (Choose two.)

  A. controlled folder access

  B. removable device restrictions

  C. signed macro requirements

  D. firewall rules creation

  E. network access control

  Correct Answer: AC

• Question 27:

  

  Refer to the exhibit. Which element in this email is an indicator of attack?

  A. IP Address: 202.142.155.218

  B. content-Type: multipart/mixed

  C. attachment: "Card-Refund"

  D. subject: "Service Credit Card"

  Correct Answer: C

• Question 28:

  

  Refer to the exhibit. Which encoding technique is represented by this HEX string?

  A. Unicode

  B. Binary

  C. Base64

  D. Charcode

  Correct Answer: B

  Reference: https://www.suse.com/c/making-sense-hexdump/

• Question 29:

  A network host is infected with malware by an attacker who uses the host to make calls for files and shuttle traffic to bots. This attack went undetected and resulted in a significant loss. The organization wants to ensure this does not happen in the future and needs a security solution that will generate alerts when command and control communication from an infected device is detected. Which network security solution should be recommended?

  A. Cisco Secure Firewall ASA

  B. Cisco Secure Firewall Threat Defense (Firepower)

  C. Cisco Secure Email Gateway (ESA)

  D. Cisco Secure Web Appliance (WSA)

  Correct Answer: B

• Question 30:

  What is a use of TCPdump?

  A. to analyze IP and other packets

  B. to view encrypted data fields

  C. to decode user credentials

  D. to change IP ports

  Correct Answer: A