Authentic Best resources for 300-215 Test Engine Practice Exam
[2021] 300-215 PDF Questions - Perfect Prospect To Go With DumpsFree Practice Exam
NEW QUESTION 21 
Refer to the exhibit. Which type of code created the snippet?
- A. Bash Script
- B. VB Script
- C. PowerShell
- D. Python
Answer: B
Explanation:
Explanation/Reference:
NEW QUESTION 22
A security team received reports of users receiving emails linked to external or unknown URLs that are non- returnable and non-deliverable. The ISP also reported a 500% increase in the amount of ingress and egress email traffic received. After detecting the problem, the security team moves to the recovery phase in their incident response plan. Which two actions should be taken in the recovery phase of this incident? (Choose two.)
- A. scan hosts with updated signatures
- B. verify the breadth of the attack
- C. collect logs
- D. remove vulnerabilities
- E. request packet capture
Answer: A,D
NEW QUESTION 23 
Refer to the exhibit. According to the SNORT alert, what is the attacker performing?
- A. brute-force attack against directories and files on the target webserver
- B. brute-force attack against the web application user accounts
- C. SQL injection attack against the target webserver
- D. XSS attack against the target webserver
Answer: A
Explanation:
Explanation
NEW QUESTION 24
An investigator is analyzing an attack in which malicious files were loaded on the network and were undetected. Several of the images received during the attack include repetitive patterns. Which anti-forensic technique was used?
- A. spoofing
- B. obfuscation
- C. steganography
- D. tunneling
Answer: C
NEW QUESTION 25
A security team receives reports of multiple files causing suspicious activity on users' workstations. The file attempted to access highly confidential information in a centralized file server. Which two actions should be taken by a security analyst to evaluate the file in a sandbox? (Choose two.)
- A. Inspect PE header.
- B. Inspect file hash.
- C. Inspect processes.
- D. Inspect registry entries
- E. Inspect file type.
Answer: B,C
NEW QUESTION 26
Refer to the exhibit.
Which determination should be made by a security analyst?
- A. An email was sent with an attachment named "Final Report.doc".
- B. An email was sent with an attachment named "Grades.doc.exe".
- C. An email was sent with an attachment named "Final Report.doc.exe".
- D. An email was sent with an attachment named "Grades.doc".
Answer: C
NEW QUESTION 27
An engineer is investigating a ticket from the accounting department in which a user discovered an unexpected application on their workstation. Several alerts are seen from the intrusion detection system of unknown outgoing internet traffic from this workstation. The engineer also notices a degraded processing capability, which complicates the analysis process. Which two actions should the engineer take? (Choose two.)
- A. Replace the faulty CPU.
- B. Restore to a system recovery point.
- C. Disconnect from the network.
- D. Take an image of the workstation.
- E. Format the workstation drives.
Answer: B,D
NEW QUESTION 28
An engineer received a report of a suspicious email from an employee. The employee had already opened the attachment, which was an empty Word document. The engineer cannot identify any clear signs of compromise but while reviewing running processes, observes that PowerShell.exe was spawned by cmd.exe with a grandparent winword.exe process. What is the recommended action the engineer should take?
- A. Investigate the sender of the email and communicate with the employee to determine the motives.
- B. Monitor processes as this a standard behavior of Word macro embedded documents.
- C. Upload the file signature to threat intelligence tools to determine if the file is malicious.
- D. Contain the threat for further analysis as this is an indication of suspicious activity.
Answer: C
NEW QUESTION 29
Drag and drop the cloud characteristic from the left onto the challenges presented for gathering evidence on the right.
Answer:
Explanation:
NEW QUESTION 30
Over the last year, an organization's HR department has accessed data from its legal department on the last day of each month to create a monthly activity report. An engineer is analyzing suspicious activity alerted by a threat intelligence platform that an authorized user in the HR department has accessed legal data daily for the last week. The engineer pulled the network data from the legal department's shared folders and discovered above average-size data dumps. Which threat actor is implied from these artifacts?
- A. privilege escalation
- B. malicious insider
- C. external exfiltration
- D. internal user errors
Answer: B
NEW QUESTION 31
What is the transmogrify anti-forensics technique?
- A. sending malicious files over a public network by encapsulation
- B. hiding a section of a malicious file in unused areas of a file
- C. concealing malicious files in ordinary or unsuspecting places
- D. changing the file header of a malicious file to another file type
Answer: D
Explanation:
Explanation/Reference:
https://www.csoonline.com/article/2122329/the-rise-of-anti-forensics.html#:~:text=Transmogrify%20is%
20similarly%20wise%20to,a%20file%20from%2C%20say%2C%20.
NEW QUESTION 32
Refer to the exhibit.
What is the IOC threat and URL in this STIX JSON snippet?
- A. malware; 'http://x4z9arb.cn/4712/'
- B. x4z9arb backdoor; http://x4z9arb.cn/4712/
- C. stix; 'http://x4z9arb.cn/4712/'
- D. malware; x4z9arb backdoor
- E. malware; malware--162d917e-766f-4611-b5d6-652791454fca
Answer: E
NEW QUESTION 33
Refer to the exhibit.
What should be determined from this Apache log?
- A. The certificate file has been maliciously modified
- B. The SSL traffic setup is improper
- C. The private key does not match with the SSL certificate.
- D. A module named mod_ssl is needed to make SSL connections.
Answer: B
NEW QUESTION 34
Which scripts will search a log file for the IP address of 192.168.100.100 and create an output file named parsed_host.log while printing results to the console?
- A. Option A
- B. Option D
- C. Option B
- D. Option C
Answer: A
NEW QUESTION 35
An attacker embedded a macro within a word processing file opened by a user in an organization's legal department. The attacker used this technique to gain access to confidential financial dat a. Which two recommendations should a security expert make to mitigate this type of attack? (Choose two.)
- A. firewall rules creation
- B. network access control
- C. signed macro requirements
- D. controlled folder access
- E. removable device restrictions
Answer: C,D
NEW QUESTION 36
Which tool is used for reverse engineering malware?
- A. Ghidra
- B. NMAP
- C. Wireshark
- D. SNORT
Answer: A
NEW QUESTION 37
What are YARA rules based upon?
- A. HTML code
- B. IP addresses
- C. binary patterns
- D. network artifacts
Answer: C
Explanation:
Explanation/Reference: https://en.wikipedia.org/wiki/YARA#:~:text=YARA%20is%20the%20name%20of,strings%20and
%20a%20boolean%20expression.
NEW QUESTION 38
A threat actor attempts to avoid detection by turning data into a code that shifts numbers to the right four times. Which anti-forensics technique is being used?
- A. obfuscation
- B. poisoning
- C. encryption
- D. tunneling
Answer: A
Explanation:
Reference:
#:~:text=Obfuscation%20of%20character%20strings%20is,data%20when%20the%20code%20executes.
NEW QUESTION 39
Refer to the exhibit.
According to the SNORT alert, what is the attacker performing?
- A. brute-force attack against directories and files on the target webserver
- B. brute-force attack against the web application user accounts
- C. SQL injection attack against the target webserver
- D. XSS attack against the target webserver
Answer: A
NEW QUESTION 40
An organization uses a Windows 7 workstation for access tracking in one of their physical data centers on which a guard documents entrance/exit activities of all personnel. A server shut down unexpectedly in this data center, and a security specialist is analyzing the case. Initial checks show that the previous two days of entrance/exit logs are missing, and the guard is confident that the logs were entered on the workstation. Where should the security specialist look next to continue investigating this case?
- A. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ProfileList
- B. HKEY_CURRENT_USER\Software\Classes\Winlog
- C. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon
- D. HKEY_LOCAL_MACHINES\SOFTWARE\Microsoft\WindowsNT\CurrentUser
Answer: C
NEW QUESTION 41
......
Best updated resource for 300-215 Online Practice Exam: https://www.dumpsfree.com/300-215-valid-exam.html
Realistic Practice 300-215 Conducting Forensic Analysis & Incident Response Using Cisco Technologies for CyberOps Exam Braindumps: https://drive.google.com/open?id=1X62bxlghIDGonmts_Sp37IBdwgQNolV4