Cisco CyberOps Professional 300-215 Questions & Answers

• Question 51:

  

  Refer to the exhibit. A network engineer is analyzing a Wireshark file to determine the HTTP request that caused the initial Ursnif banking Trojan binary to download. Which filter did the engineer apply to sort the Wireshark traffic logs?

  A. http.request.un matches

  B. tls.handshake.type ==1

  C. tcp.port eq 25

  D. tcp.window_size ==0

  Correct Answer: B

  Reference:

  https://www.malware-traffic-analysis.net/2018/11/08/index.html

  https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-ursnif-infections/

• Question 52:

  What is a concern for gathering forensics evidence in public cloud environments?

  A. High Cost: Cloud service providers typically charge high fees for allowing cloud forensics.

  B. Configuration: Implementing security zones and proper network segmentation.

  C. Timeliness: Gathering forensics evidence from cloud service providers typically requires substantial time.

  D. Multitenancy: Evidence gathering must avoid exposure of data from other tenants.

  Correct Answer: D

  Reference: https://www.researchgate.net/publication/307871954_About_Cloud_Forensics_Challenges_and_Solutions

• Question 53:

  Which scripts will search a log file for the IP address of 192.168.100.100 and create an output file named parsed_host.log while printing results to the console?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: A

• Question 54:

  What is the transmogrify anti-forensics technique?

  A. hiding a section of a malicious file in unused areas of a file

  B. sending malicious files over a public network by encapsulation

  C. concealing malicious files in ordinary or unsuspecting places

  D. changing the file header of a malicious file to another file type

  Correct Answer: D

  Reference: https://www.csoonline.com/article/2122329/the-rise-of-anti-forensics.html#:~:text=Transmogrify%20is%20similarly%20wise%20to,a%20file%20from%2C%20say%2C%20.

• Question 55:

  A security team is discussing lessons learned and suggesting process changes after a security breach incident. During the incident, members of the security team failed to report the abnormal system activity due to a high project workload. Additionally, when the incident was identified, the response took six hours due to management being unavailable to provide the approvals needed. Which two steps will prevent these issues from occurring in the future? (Choose two.)

  A. Introduce a priority rating for incident response workloads.

  B. Provide phishing awareness training for the fill security team.

  C. Conduct a risk audit of the incident response workflow.

  D. Create an executive team delegation plan.

  E. Automate security alert timeframes with escalation triggers.

  Correct Answer: AE

• Question 56:

  An engineer is investigating a ticket from the accounting department in which a user discovered an unexpected application on their workstation. Several alerts are seen from the intrusion detection system of unknown outgoing internet traffic from this workstation. The engineer also notices a degraded processing capability, which complicates the analysis process. Which two actions should the engineer take? (Choose two.)

  A. Restore to a system recovery point.

  B. Replace the faulty CPU.

  C. Disconnect from the network.

  D. Format the workstation drives.

  E. Take an image of the workstation.

  Correct Answer: AE

• Question 57:

  DRAG DROP

  Drag and drop the cloud characteristic from the left onto the challenges presented for gathering evidence on the right.

  Select and Place:

  

  Correct Answer:

  

• Question 58:

  DRAG DROP

  Drag and drop the steps from the left into the order to perform forensics analysis of infrastructure networks on the right.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://subscription.packtpub.com/book/networking_and_servers/9781789344523/1/ch01lvl1sec12/network-forensics-investigation-methodology

• Question 59:

  DRAG DROP

  Drag and drop the capabilities on the left onto the Cisco security solutions on the right.

  Select and Place:

  

  Correct Answer: