Conducting Forensic Analysis & Incident Response Using Cisco Technologies for CyberOps

Question 1

A SOC team identifies the presence of APT29. The threat actor gained access to the environment through a phishing email sent to the communications manager one year earlier. APT29 is also known to exploit vulnerabilities remotely to gain access to victims' systems. The SOC team takes the necessary actions and removes the backdoor. What is the next recommended step to protect the environment?

A. Deploy a cyber threat intelligence solution.

B. Run an antimalware scan on all devices.

C. Share a detailed incident report with senior management.

D. Deploy an email sandbox solution.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 2

An attacker modifies a malicious file named TOPSECRET0523619132 by changing its file extension from a .
png to a doc in an attempt to evade detection. Which technique is being used to disguise the file?

A. obfuscatiofi

B. hashing

C. steganography

D. spoofing

Correct Answer: A

Question 3

Refer to the exhibit.

A security analyst is reviewing alerts from the SIEM system that was just implemented and notices a possible indication of an attack because the SSHD system just went live and there should be nobody using it. Which action should the analyst take to respond to the alert?

A. Investigate the alert by checking SSH logs and correlating with other relevant data in SIEM.

B. Reset the admin password in SSHD to prevent unauthorized access to the system at scale.

C. Immediately block the IP address 192.168.1.100 from accessing the SSHD environment.

D. Ignore the alert and continue monitoring for further activity because the system was just implemented.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 4

A. Analyze the activity paths in Cisco Secure Malware Analytics.

B. Analyze the registry activity section in Cisco Umbrella.

C. Evaluate the file activity in Cisco Umbrella.

D. Evaluate the artifacts in Cisco Secure Malware Analytics.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 5

Refer to the exhibit.

Which two determinations should be made about the attack from the Apache access logs? (Choose two.)

A. The attacker used the WordPress file manager plugin to upload r57.php.

B. The attacker performed a brute force attack against WordPress and used SQL injection against the backend database.

C. The attacker logged on normally to WordPress admin page.

D. The attacker used r57 exploit to elevate their privilege.

E. The attacker uploaded the WordPress file manager trojan.

Correct Answer: A,E

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 6

Which issue affects chain of custody in cloud-forensic investigations?

A. Cloud-based systems within enterprise environments lack authentication mechanisms.

B. Sensitive data stored across distributed cloud infrastructure cannot be encrypted.

C. Limited visibility into audit trails within cloud-service platforms can complicate forensic investigations.

D. Investigators must rely on the cloud provider to collect and preserve evidence during an investigation.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 7

A security team receives reports of multiple files causing suspicious activity on users' workstations. The file attempted to access highly confidential information in a centralized file server. Which two actions should be taken by a security analyst to evaluate the file in a sandbox? (Choose two.)

A. Inspect PE header.

B. Inspect file type.

C. Inspect registry entries

D. Inspect file hash.

E. Inspect processes.

Correct Answer: A,E

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 8

An incident response analyst is preparing to scan memory using a YARA rule. How is this task completed?

A. string matching

B. data diddling

C. deobfuscation

D. XML injection

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 9

Refer to the exhibit. TrickBot malware infects a Windows 10 computer. Which IOC from the capture enables the security analyst to identify and remove the malware?

A. imgpaper.png

B. ATBOXLGQOOBDZTLA

C. YAS20.exe

D. bolton-tech.com

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 10

What is the goal of an incident response plan?

A. to contain an attack and prevent it from spreading

B. to identify critical systems and resources in an organization

C. to ensure systems are in place to prevent an attack

D. to determine security weaknesses and recommend solutions

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 11

A security team received reports of users receiving emails linked to external or unknown URLs that are non- returnable and non-deliverable. The ISP also reported a 500% increase in the amount of ingress and egress email traffic received. After detecting the problem, the security team moves to the recovery phase in their incident response plan. Which two actions should be taken in the recovery phase of this incident? (Choose two.)

A. verify the breadth of the attack

B. remove vulnerabilities

C. scan hosts with updated signatures

D. request packet capture

E. collect logs

Correct Answer: B,C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 12

An engineer notices irregular traffic spikes during off-hours in a network-monitoring tool. The spikes involve large outbound data transfers to an IP address geolocated in a high-risk jurisdiction. The traffic uses encrypted channels typically associated with secure file transfers. Which action should the engineer take to analyze the network traffic associated with these potentially malicious activities?

A. Increase network bandwidth to accommodate the spikes and avoid potential service disruptions.

B. Schedule a maintenance window to update network-encryption protocols and continue monitoring for further anomalies.

C. Disregard the traffic as a false positive because encrypted channels imply secure communication.

D. Use the network-monitoring tool to track packet payloads and destinations, and cross-reference them with threat-intelligence databases for known malicious IP addresses or domains.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 13

Which scripts will search a log file for the IP address of 192.168.100.100 and create an output file named parsed_host.log while printing results to the console?

A. Option D

B. Option B

C. Option A

D. Option C

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 14

Refer to the exhibit.

The application x-dosexec with hash
691c65e4fb1d19f82465df1d34ad51aaeceba14a78167262dc7b2840a6a6aa87 is reported as malicious and labeled as " Trojan.Generic " by the threat intelligence tool. What is considered an indicator of compromise?

A. data compression

B. modified registry

C. process injection

D. hooking

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Cisco Conducting Forensic Analysis & Incident Response Using Cisco Technologies for CyberOps - 300-215 Exam Practice Test

Latest Update

Useful Links

Contact Us