300-215: Conducting Forensic Analysis & Incident Response Using Cisco Technologies for CyberOps

A security team is discussing lessons learned and suggesting process changes after a security breach incident. During the incident, members of the security team failed to report the abnormal system activity due to a high project workload.

Additionally, when the incident was identified, the response took six hours due to management being unavailable to provide the approvals needed. Which two steps will prevent these issues from occurring in the future? (Choose two.)

Introduce a priority rating for incident response workloads.
Provide phishing awareness training for the fill security team.
Conduct a risk audit of the incident response workflow.
Create an executive team delegation plan.
Automate security alert timeframes with escalation triggers.

Correct answer: AE

An engineer is investigating a ticket from the accounting department in which a user discovered an unexpected application on their workstation. Several alerts are seen from the intrusion detection system of unknown outgoing internet traffic from this workstation. The engineer also notices a degraded processing capability, which complicates the analysis process. Which two actions should the engineer take? (Choose two.)

Restore to a system recovery point.
Replace the faulty CPU.
Disconnect from the network.
Format the workstation drives.
Take an image of the workstation.

Correct answer: AE

Refer to the exhibit. What should an engineer determine from this Wireshark capture of suspicious network traffic?

There are signs of SYN flood attack, and the engineer should increase the backlog and recycle the oldest half-open TCP connections.
There are signs of a malformed packet attack, and the engineer should limit the packet size and set a threshold of bytes as a countermeasure.
There are signs of a DNS attack, and the engineer should hide the BIND version and restrict zone transfers as a countermeasure.
There are signs of ARP spoofing, and the engineer should use Static ARP entries and IP address-to-MAC address mappings as a countermeasure.

Correct answer: A

Refer to the exhibit. A network engineer is analyzing a Wireshark file to determine the HTTP request that caused the initial Ursnif banking Trojan binary to download. Which filter did the engineer apply to sort the Wireshark traffic logs?

http.request.un matches
tls.handshake.type ==1
tcp.port eq 25
tcp.window_size ==0

Correct answer: B

Explanation:

Reference:https://www.malware-traffic-analysis.net/2018/11/08/index.htmlhttps://unit42.paloaltonetworks.com/wireshark-tutorial-examining-ursnif-infections/

Reference:

https://www.malware-traffic-analysis.net/2018/11/08/index.html

https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-ursnif-infections/

What is a concern for gathering forensics evidence in public cloud environments?

High Cost: Cloud service providers typically charge high fees for allowing cloud forensics.
Configuration: Implementing security zones and proper network segmentation.
Timeliness: Gathering forensics evidence from cloud service providers typically requires substantial time.
Multitenancy: Evidence gathering must avoid exposure of data from other tenants.

Correct answer: D

Explanation:

Reference: https://www.researchgate.net/publication/307871954_About_Cloud_Forensics_Challenges_and_Solutions

Which scripts will search a log file for the IP address of 192.168.100.100 and create an output file named parsed_host.log while printing results to the console?

Correct answer: A

What is the transmogrify anti-forensics technique?

hiding a section of a malicious file in unused areas of a file
sending malicious files over a public network by encapsulation
concealing malicious files in ordinary or unsuspecting places
changing the file header of a malicious file to another file type

Correct answer: D

Explanation:

Reference: https://www.csoonline.com/article/2122329/the-rise-of-anti-forensics.html#:~:text=Transmogrify%20is%20similarly%20wise%20to,a%20file%20from%2C%20say%2C%20.

What is the steganography anti-forensics technique?

hiding a section of a malicious file in unused areas of a file
changing the file header of a malicious file to another file type
sending malicious files over a public network by encapsulation
concealing malicious files in ordinary or unsuspecting places

Correct answer: A

Explanation:

https://blog.eccouncil.org/6-anti-forensic-techniques-that-every-cyber-investigator-dreads/

A security team receives reports of multiple files causing suspicious activity on users' workstations. The file attempted to access highly confidential information in a centralized file server. Which two actions should be taken by a security analyst to evaluate the file in a sandbox? (Choose two.)

Inspect registry entries
Inspect processes.
Inspect file hash.
Inspect file type.
Inspect PE header.

Correct answer: BC

Explanation:

Reference: https://medium.com/@Flying_glasses/top-5-ways-to-detect-malicious-file-manually-d02744f7c43a

Refer to the exhibit.

An engineer is analyzing a .LNK (shortcut) file recently received as an email attachment and blocked by email security as suspicious. What is the next step an engineer should take?

Delete the suspicious email with the attachment as the file is a shortcut extension and does not represent any threat.
Upload the file to a virus checking engine to compare with well-known viruses as the file is a virus disguised as a legitimate extension.
Quarantine the file within the endpoint antivirus solution as the file is a ransomware which will encrypt the documents of a victim.
Open the file in a sandbox environment for further behavioral analysis as the file contains a malicious script that runs on execution.

Correct answer: D

Vendor:	Cisco
Exam Code:	300-215
Exam Name:	Conducting Forensic Analysis & Incident Response Using Cisco Technologies for CyberOps
Date:	Dec 17, 2020
File Size:	7 MB
Downloads:	1

Download Conducting Forensic Analysis & Incident Response Using Cisco Technologies for CyberOps.300-215.VCEplus.2020-12-17.58q.vcex

How to open VCEX files?

Demo Questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

ProfExam at a 20% markdown