Cisco CyberOps Professional 300-215 Questions & Answers

• Question 31:

  An incident response team is recommending changes after analyzing a recent compromise in which:

  a large number of events and logs were involved;

  team members were not able to identify the anomalous behavior and escalate it in a timely manner;

  several network systems were affected as a result of the latency in detection;

  security engineers were able to mitigate the threat and bring systems back to a stable state; and

  the issue reoccurred shortly after and systems became unstable again because the correct information was not gathered during the initial identification phase.

  Which two recommendations should be made for improving the incident response process? (Choose two.)

  A. Formalize reporting requirements and responsibilities to update management and internal stakeholders throughout the incident-handling process effectively.

  B. Improve the mitigation phase to ensure causes can be quickly identified, and systems returned to a functioning state.

  C. Implement an automated operation to pull systems events/logs and bring them into an organizational context.

  D. Allocate additional resources for the containment phase to stabilize systems in a timely manner and reduce an attack's breadth.

  E. Modify the incident handling playbook and checklist to ensure alignment and agreement on roles, responsibilities, and steps before an incident occurs.

  Correct Answer: CE

• Question 32:

  

  Refer to the exhibit. An engineer is analyzing a TCP stream in a Wireshark after a suspicious email with a URL. What should be determined about the SMB traffic from this stream?

  A. It is redirecting to a malicious phishing website,

  B. It is exploiting redirect vulnerability C. It is requesting authentication on the user site.

  D. It is sharing access to files and printers.

  Correct Answer: B

• Question 33:

  What is the goal of an incident response plan?

  A. to identify critical systems and resources in an organization

  B. to ensure systems are in place to prevent an attack

  C. to determine security weaknesses and recommend solutions

  D. to contain an attack and prevent it from spreading

  Correct Answer: D

  Reference: https://www.forcepoint.com/cyber-edu/incident-response

• Question 34:

  A security team received an alert of suspicious activity on a user's Internet browser. The user's anti-virus software indicated that the file attempted to create a fake recycle bin folder and connect to an external IP address. Which two actions should be taken by the security analyst with the executable file for further analysis? (Choose two.)

  A. Evaluate the process activity in Cisco Umbrella.

  B. Analyze the TCP/IP Streams in Cisco Secure Malware Analytics (Threat Grid).

  C. Evaluate the behavioral indicators in Cisco Secure Malware Analytics (Threat Grid).

  D. Analyze the Magic File type in Cisco Umbrella.

  E. Network Exit Localization in Cisco Secure Malware Analytics (Threat Grid).

  Correct Answer: BC

• Question 35:

  An employee receives an email from a "trusted" person containing a hyperlink that is malvertising. The employee clicks the link and the malware downloads. An information analyst observes an alert at the SIEM and engages the cybersecurity team to conduct an analysis of this incident in accordance with the incident response plan. Which event detail should be included in this root cause analysis?

  A. phishing email sent to the victim

  B. alarm raised by the SIEM

  C. information from the email header

  D. alert identified by the cybersecurity team

  Correct Answer: B

• Question 36:

  

  Refer to the exhibit. Which two actions should be taken based on the intelligence information? (Choose two.)

  A. Block network access to all .shop domains

  B. Add a SIEM rule to alert on connections to identified domains.

  C. Use the DNS server to block hole all .shop requests.

  D. Block network access to identified domains.

  E. Route traffic from identified domains to block hole.

  Correct Answer: BD

• Question 37:

  

  Refer to the exhibit. Which two determinations should be made about the attack from the Apache access logs? (Choose two.)

  A. The attacker used r57 exploit to elevate their privilege.

  B. The attacker uploaded the word press file manager trojan.

  C. The attacker performed a brute force attack against word press and used sql injection against the backend database.

  D. The attacker used the word press file manager plugin to upoad r57.php.

  E. The attacker logged on normally to word press admin page.

  Correct Answer: CD

• Question 38:

  

  Refer to the exhibit. Which type of code is being used?

  A. Shell

  B. VBScript

  C. BASH

  D. Python

  Correct Answer: D

• Question 39:

  What is the function of a disassembler?

  A. aids performing static malware analysis

  B. aids viewing and changing the running state

  C. aids transforming symbolic language into machine code

  D. aids defining breakpoints in program execution

  Correct Answer: A

  Reference: https://scholar.google.co.in/scholar?q=disassembler+aids+performing+static+malware+analysisandhl=enandas_sdt=0andas_vis=1andoi=scholart

• Question 40:

  An "unknown error code" is appearing on an ESXi host during authentication. An engineer checks the authentication logs but is unable to identify the issue. Analysis of the vCenter agent logs shows no connectivity errors. What is the next log file the engineer should check to continue troubleshooting this error?

  A. /var/log/syslog.log

  B. /var/log/vmksummary.log

  C. var/log/shell.log

  D. var/log/general/log

  Correct Answer: A

  Reference: https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.monitoring.doc/GUID-832A2618-6B11-4A28-9672-93296DA931D0.html