Cisco 300-215 CBRFIR Exam Questions and Answers

Question #1

A security team is discussing lessons learned and suggesting process changes after a security breach incident. During the incident, members of the security team failed to report the abnormal system activity due to a high project workload. Additionally, when the incident was identified, the response took six hours due to management being unavailable to provide the approvals needed. Which two steps will prevent these issues from occurring in the future? (Choose two.)

A. ntroduce a priority rating for incident response workloads

B. rovide phishing awareness training for the fill security team

C. onduct a risk audit of the incident response workflow

D. reate an executive team delegation plan

E. utomate security alert timeframes with escalation triggers

View answer

Correct Answer: AE

Question #2

An engineer is investigating a ticket from the accounting department in which a user discovered an unexpected application on their workstation. Several alerts are seen from the intrusion detection system of unknown outgoing internet traffic from this workstation. The engineer also notices a degraded processing capability, which complicates the analysis process. Which two actions should the engineer take? (Choose two.)

A. estore to a system recovery point

B. eplace the faulty CPU

C. isconnect from the network

D. ormat the workstation drives

E. ake an image of the workstation

View answer

Correct Answer: AE

Question #3

Refer to the exhibit. What should an engineer determine from this Wireshark capture of suspicious network traffic?

A. here are signs of SYN flood attack, and the engineer should increase the backlog and recycle the oldest half-open TCP connections

B. here are signs of a malformed packet attack, and the engineer should limit the packet size and set a threshold of bytes as a countermeasure

C. here are signs of a DNS attack, and the engineer should hide the BIND version and restrict zone transfers as a countermeasure

D. here are signs of ARP spoofing, and the engineer should use Static ARP entries and IP address-to-MAC address mappings as a countermeasure

View answer

Correct Answer: A

Question #4

Refer to the exhibit. A network engineer is analyzing a Wireshark file to determine the HTTP request that caused the initial Ursnif banking Trojan binary to download. Which filter did the engineer apply to sort the Wireshark traffic logs?

A. ttp

B. ls

C. cp

D. cp

View answer

Correct Answer: B

Question #5

An incident response team is recommending changes after analyzing a recent compromise in which:? a large number of events and logs were involved;? team members were not able to identify the anomalous behavior and escalate it in a timely manner;? several network systems were affected as a result of the latency in detection;? security engineers were able to mitigate the threat and bring systems back to a stable state; and? the issue reoccurred shortly after and systems became unstable again because the correc

A. Formalize reporting requirements and responsibilities to update management and internal stakeholders throughout the incident-handling process effectively

B. Improve the mitigation phase to ensure causes can be quickly identified, and systems returned to a functioning state

C. Implement an automated operation to pull systems events/logs and bring them into an organizational context

D. Allocate additional resources for the containment phase to stabilize systems in a timely manner and reduce an attack"?s breadth

E. Modify the incident handling playbook and checklist to ensure alignment and agreement on roles, responsibilities, and steps before an incident occurs

View answer

Correct Answer: CE

Question #6

Which information is provided bout the object file by the "-h" option in the objdump line command objdump ""b oasys ""m vax ""h fu.o?

A. bfdname

B. debugging

C. help

D. headers

View answer

Correct Answer: D

Question #7

A threat actor attempts to avoid detection by turning data into a code that shifts numbers to the right four times. Which anti-forensics technique is being used?

A. encryption

B. tunneling

C. obfuscation

D. poisoning

View answer

Correct Answer: C

Question #8

Which technique is used to evade detection from security products by executing arbitrary code in the address space of a separate live operation?

A. process injection

B. privilege escalation

C. GPO modification

D. token manipulation

View answer

Correct Answer: A

Question #9

Which magic byte indicates that an analyzed file is a pdf file?

A. cGRmZmlsZQ

B. 706466666

C. 255044462d

D. 0a0ah4cg

View answer

Correct Answer: C

Question #10

An engineer received a call to assist with an ongoing DDoS attack. The Apache server is being targeted, and availability is compromised. Which step should be taken to identify the origin of the threat?

A. An engineer should check the list of usernames currently logged in by running the command $ who | cut ""d"? "? -f1| sort | uniq

B. An engineer should check the server"?s processes by running commands ps -aux and sudo ps -a

C. An engineer should check the services on the machine by running the command service -status-all

D. An engineer should check the last hundred entries of a web server with the command sudo tail -100 /var/log/apache2/access

View answer

Correct Answer: D

Question #11

01. What is the steganography anti-forensics technique?

A. idingasectionofamaliciousfileinunusedareasofafile

B. hangingthefileheaderofamaliciousfiletoanotherfiletype

C. endingmaliciousfilesoverapublicnetworkbyencapsulati

D. oncealingmaliciousfilesinordinaryorunsuspectingplace

View answer

Correct Answer: D

Question #12

02. A security team detected an above-average amount of inbound tcp/135 connection attempts from unidentified senders. The security team is responding based on their incident response playbook.

A. nti-malwaresoftware

B. ataandworkloadisolati

C. entralizedusermanageme

D. ntrusionpreventionsystem

View answer

Correct Answer: CD

Question #13

03. An engineer received a call to assist with an ongoing DDoS attack. The Apache server is being targeted, and availability is compromised. Which step should be taken to identify the origin of the threat?

A. ighCost:Cloudserviceproviderstypicallychargehighfeesforallowingcloudforensics

B. onfiguration:Implementingsecurityzonesandpropernetworksegmentation

C . imeliness:Gatheringforensicsevidencefromcloudserviceproviderstypicallyrequiressubstantialtime

D. ultitenancy:Evidencegatheringmustavoidexposureofdatafromothertenants

View answer

Correct Answer: B

Question #14

04. What is a concern for gathering forensics evidence in public cloud environments?

A. idsperformingstaticmalwareanalysi

B. idsviewingandchangingtherunningstate

C. idstransformingsymboliclanguageintomachinecode

D. idsdefiningbreakpointsinprogramexecuti

View answer

Correct Answer: D

Question #15

05. A security team received an alert of suspicious activity on a user’s Internet browser. The user’s anti-virus software indicated that the file attempted to create a fake recycle bin folder and connect to an external IP address.

A. fdname

B. ebuggi

C. eade

D. elp

View answer

Correct Answer: BC

Question #16

06. What is the function of a disassembler?

A. rocessinjecti

B. rivilegeescalati

C. POmodificati

D. okenmanipulati

View answer

Correct Answer: A

Question #17

07. Which information is provided bout the object file by the “-h” option in the objdump line command objdump –b oasys –m vax –h fu.o?

A. rivilegeescalati

B. nternalusere

C. aliciousinside

D. xternalexfiltrati

View answer

Correct Answer: C

Question #18

Refer to the exhibit.What should be determined from this Apache log?

A. module named mod_ssl is needed to make SSL connections

B. he private key does not match with the SSL certificate

C. he certificate file has been maliciously modified

D. he SSL traffic setup is improper

View answer

Correct Answer: D

Question #19

What are YARA rules based upon?

A. inary patterns

B. TML code

C. etwork artifacts

D. P addresses

View answer

Correct Answer: A

Question #20

Refer to the exhibit.According to the Wireshark output, what are two indicators of compromise for detecting an Emotet malware download? (Choose two.)

A. omain name

B. erver

C. ash value

D. ilename= ''Fy

E. ontent-Type

View answer

Correct Answer: CE

Question #21

Refer to the exhibit.An employee notices unexpected changes and setting modifications on their workstation and creates an incident ticket. A support specialist checks processes and services but does not identify anything suspicious. The ticket was escalated to an analyst who reviewed this event log and also discovered that the workstation had multiple large data dumps on network shares. What should be determined from this information?

A. ata obfuscation

B. econnaissance attack

C. rute-force attack

D. og tampering

View answer

Correct Answer: B

Question #22

Refer to the exhibit.A company that uses only the Unix platform implemented an intrusion detection system. After the initial configuration, the number of alerts is overwhelming, and an engineer needs to analyze and classify the alerts. The highest number of alerts were generated from the signature shown in the exhibit. Which classification should the engineer assign to this event?

A. rue Negative alert

B. alse Negative alert

C. alse Positive alert

D. rue Positive alert

View answer

Correct Answer: C

Question #23

A security team is discussing lessons learned and suggesting process changes after a security breach incident. During the incident, members of the security team failed to report the abnormal system activity due to a high project workload. Additionally, when the incident was identified, the response took six hours due to management being unavailable to provide the approvals needed. Which two steps will prevent these issues from occurring in the future? (Choose two.)

A. here are signs of SYN flood attack, and the engineer should increase the backlog and recycle the oldest half-open TCP connections

B. here are signs of a malformed packet attack, and the engineer should limit the packet size and set a threshold of bytes as a countermeasure

C. here are signs of a DNS attack, and the engineer should hide the BIND version and restrict zone transfers as a countermeasure

D. here are signs of ARP spoofing, and the engineer should use Static ARP entries and IP address-to-MAC address mappings as a countermeasure

View answer

Correct Answer: AE

Question #24

An engineer is investigating a ticket from the accounting department in which a user discovered an unexpected application on their workstation. Several alerts are seen from the intrusion detection system of unknown outgoing internet traffic from this workstation. The engineer also notices a degraded processing capability, which complicates the analysis process. Which two actions should the engineer take? (Choose two.)

A. ttp

B. ls

C. cp

D. cp

View answer

Correct Answer: AE

Question #25

What is a concern for gathering forensics evidence in public cloud environments?

A. igh Cost: Cloud service providers typically charge high fees for allowing cloud forensics

B. onfiguration: Implementing security zones and proper network segmentation

C. imeliness: Gathering forensics evidence from cloud service providers typically requires substantial time

D. ultitenancy: Evidence gathering must avoid exposure of data from other tenants

View answer

Correct Answer: D

Question #26

What is the transmogrify anti- forensics technique?

A. iding a section of a malicious file in unused areas of a file

B. ending malicious files over a public network by encapsulation

C. oncealing malicious files in ordinary or unsuspecting places

D. hanging the file header of a malicious file to another file type

View answer

Correct Answer: D

Question #27

What is the steganography anti- forensics technique?

A. iding a section of a malicious file in unused areas of a file

B. hanging the file header of a malicious file to another file type

C. ending malicious files over a public network by encapsulation

D. oncealing malicious files in ordinary or unsuspecting places

View answer

Correct Answer: A

Question #28

A security team receives reports of multiple files causing suspicious activity on users’ workstations. The file attempted to access highly confidential information in a centralized file server. Which two actions should be taken by a security analyst to evaluate the file in a sandbox? (Choose two.)

A. elete the suspicious email with the attachment as the file is a shortcut extension and does not represent any threat

B. pload the file to a virus checking engine to compare with well-known viruses as the file is a virus disguised as a legitimate extension

C. uarantine the file within the endpoint antivirus solution as the file is a ransomware which will encrypt the documents of a victim

D. pen the file in a sandbox environment for further behavioral analysis as the file contains a malicious script that runs on execution

View answer

Correct Answer: BC

Question #29

Refer to the exhibit. An engineer is analyzing a .LNK (shortcut) file recently received as an email attachment and blocked by email security as suspicious. What is the next step an engineer should take?

A. poofing

B. bfuscation

C. unneling

D. teganography

View answer

Correct Answer: D

Question #30

Which tool conducts memory analysis?

A. emDump

B. ysinternals Autoruns

C. olatility

D. emoryze

View answer

Correct Answer: C

Question #31

Refer to the exhibit. What is the IOC threat and URL in this STIX JSON snippet?

A. alware; ‘http://x4z9arb

B. alware; x4z9arb backdoor

C. 4z9arb backdoor; http://x4z9arb

D. alware; malware--162d917e-766f-4611-b5d6-652791454fca

E. tix; ‘http://x4z9arb

View answer

Correct Answer: D

Question #32

Refer to the exhibit. Which type of code is being used?

A. hell

B. BScript

C. ASH

D. ython

View answer

Correct Answer: D

Question #33

What is the function of a disassembler?

A. ids performing static malware analysis

B. ids viewing and changing the running state

C. ids transforming symbolic language into machine code

D. ids defining breakpoints in program execution

View answer

Correct Answer: A

Question #34

An “unknown error code” is appearing on an ESXi host during authentication. An engineer checks the authentication logs but is unable to identify the issue. Analysis of the vCenter agent logs shows no connectivity errors. What is the next log file the engineer should check to continue troubleshooting this error?

A. var/log/syslog

B. var/log/vmksummary

C. ar/log/shell

D. ar/log/general/log

View answer

Correct Answer: A

Question #35

Over the last year, an organization’s HR department has accessed data from its legal department on the last day of each month to create a monthly activity report. An engineer is analyzing suspicious activity alerted by a threat intelligence platform that an authorized user in the HR department has accessed legal data daily for the last week. The engineer pulled the network data from the legal department’s shared folders and discovered above average-size data dumps. Which threat actor is implied from these a

A. rivilege escalation

B. nternal user errors

C. alicious insider

D. xternal exfiltration

View answer

Correct Answer: C

Question #36

A website administrator has an output of an FTP session that runs nightly to download and unzip files to a local staging server. The download includes thousands of files, and the manual process used to find how many files failed to download is time-consuming. The administrator is working on a PowerShell script that will parse a log file and summarize how many files were successfully downloaded versus ones that failed. Which script will read the contents of the file one line at a time and return a collection

A. et-Content-Folder \\\\Server\\FTPFolder\\Logfiles\\ftpfiles

B. et-Content –ifmatch \\\\Server\\FTPFolder\\Logfiles\\ftpfiles

C. et-Content –Directory \\\\Server\\FTPFolder\\Logfiles\\ftpfiles

D. et-Content –Path \\\\Server\\FTPFolder\\Logfiles\\ftpfiles

View answer

Correct Answer: D

Question #37

Refer to the exhibit. An engineer is analyzing a TCP stream in a Wireshark after a suspicious email with a URL. What should be determined about the SMB traffic from this stream?

A. t is redirecting to a malicious phishing website,

B. t is exploiting redirect vulnerability

C. t is requesting authentication on the user site

D. t is sharing access to files and printers

View answer

Correct Answer: B

Question #38

What is the goal of an incident response plan?

A. o identify critical systems and resources in an organization

B. o ensure systems are in place to prevent an attack

C. o determine security weaknesses and recommend solutions

D. o contain an attack and prevent it from spreading

View answer

Correct Answer: D

Question #39

A security team received an alert of suspicious activity on a user’s Internet browser. The user’s anti-virus software indicated that the file attempted to create a fake recycle bin folder and connect to an external IP address. Which two actions should be taken by the security analyst with the executable file for further analysis? (Choose two.)

A. hishing email sent to the victim

B. larm raised by the SIEM

C. nformation from the email header

D. lert identified by the cybersecurity team

View answer

Correct Answer: BC

Question #40

Refer to the exhibit. Which two determinations should be made about the attack from the Apache access logs? (Choose two.)

A. P Address: 202

B. ontent-Type: multipart/mixed

C. ttachment: “Card-Refund”

D. ubject: “Service Credit Card”

View answer

Correct Answer: CD

Question #41

An attacker embedded a macro within a word processing file opened by a user in an organization’s legal department. The attacker used this technique to gain access to confidential financial data. Which two recommendations should a security expert make to mitigate this type of attack? (Choose two.)

A. nicode

B. inary

C. ase64

D. harcode

View answer

Correct Answer: AC

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now

Cisco 300-215 CBRFIR Exam Questions and Answers | Online Sample Questions

View The Updated 300-215 Exam Questions

View The Updated CCNP Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE! Get Now

Cisco 300-215 CBRFIR Exam Questions and Answers | Online Sample Questions

View The Updated 300-215 Exam Questions

View The Updated CCNP Exam Questions

View Answers after Submission

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now