Cisco Conducting Forensic Analysis & Incident Response Using Cisco Technologies for CyberOps - 300-215 Exam Practice Test
A new zero-day vulnerability is discovered in the web application. Vulnerability does not require physical access and can be exploited remotely. Attackers are exploiting the new vulnerability by submitting a form with malicious content that grants them access to the server. After exploitation, attackers delete the log files to hide traces. Which two actions should the security engineer take next? (Choose two.)
Correct Answer: B,D
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
A security team needs to prevent a remote code execution vulnerability. The vulnerability can be exploited only by sending ' ${ string in the HTTP request. WAF rule is blocking ' ${ ' , but system engineers detect that attackers are executing commands on the host anyway. Which action should the security team recommend?
Correct Answer: D
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
A cybersecurity analyst is analyzing a complex set of threat intelligence data from internal and external sources. Among the data, they discover a series of indicators, including patterns of unusual network traffic, a sudden increase in failed login attempts, and multiple instances of suspicious file access on the company ' s internal servers. Additionally, an external threat feed highlights that threat actors are actively targeting organizations in the same industry using ransomware. Which action should the analyst recommend?
Correct Answer: A
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
Which issue is associated with gathering evidence from virtualized environments provided by major cloud vendors?
Correct Answer: B
Vote an answer
Correct Answer: D
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
A security team receives reports of multiple files causing suspicious activity on users' workstations. The file attempted to access highly confidential information in a centralized file server. Which two actions should be taken by a security analyst to evaluate the file in a sandbox? (Choose two.)
Correct Answer: A,C
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
Which issue affects chain of custody in cloud-forensic investigations?
Correct Answer: B
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
An attacker embedded a macro within a word processing file opened by a user in an organization's legal department. The attacker used this technique to gain access to confidential financial data. Which two recommendations should a security expert make to mitigate this type of attack? (Choose two.)
Correct Answer: B,C
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
Refer to the exhibit.
A security analyst notices unusual connections while monitoring traffic. What is the attack vector, and which action should be taken to prevent this type of event?
A security analyst notices unusual connections while monitoring traffic. What is the attack vector, and which action should be taken to prevent this type of event?
Correct Answer: B
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
Which two tools conduct network traffic analysis in the absence of a graphical user interface? (Choose two.)
Correct Answer: B,D
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
A security team is discussing lessons learned and suggesting process changes after a security breach incident.
During the incident, members of the security team failed to report the abnormal system activity due to a high project workload. Additionally, when the incident was identified, the response took six hours due to management being unavailable to provide the approvals needed. Which two steps will prevent these issues from occurring in the future? (Choose two.)
During the incident, members of the security team failed to report the abnormal system activity due to a high project workload. Additionally, when the incident was identified, the response took six hours due to management being unavailable to provide the approvals needed. Which two steps will prevent these issues from occurring in the future? (Choose two.)
Correct Answer: A,C
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
An employee's workstation is breached, and an attacker accesses a Microsoft file-share server and steals critical files. Which two actions enable a security engineer to retrieve successful and failed file-access logs from the Microsoft Windows Server 2016 file share? (Choose two.)
Correct Answer: A,C
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
Snort detects traffic that is targeting vulnerabilities in files that belong to software in the Microsoft Office suite. On a SIEM tool, the SOC analyst sees an alert from Cisco FMC. Cisco FMC is implemented with Snort IDs. Which alert message is shown?
Correct Answer: C
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
Refer to the exhibit.
An HR department submitted a ticket to the IT helpdesk indicating slow performance on an internal share server. The helpdesk engineer checked the server with a real-time monitoring tool and did not notice anything suspicious. After checking the event logs, the engineer noticed an event that occurred 48 hours prior. Which two indicators of compromise should be determined from this information? (Choose two.)
An HR department submitted a ticket to the IT helpdesk indicating slow performance on an internal share server. The helpdesk engineer checked the server with a real-time monitoring tool and did not notice anything suspicious. After checking the event logs, the engineer noticed an event that occurred 48 hours prior. Which two indicators of compromise should be determined from this information? (Choose two.)
Correct Answer: A,D
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).