[Oct-2021] 300-215 Dumps Full Questions - CyberOps Professional Exam Study Guide
Exam Questions and Answers for 300-215 Study Guide
NEW QUESTION 18
What is the steganography anti-forensics technique?
- A. changing the file header of a malicious file to another file type
- B. sending malicious files over a public network by encapsulation
- C. hiding a section of a malicious file in unused areas of a file
- D. concealing malicious files in ordinary or unsuspecting places
Answer: C
Explanation:
Explanation/Reference:
https://blog.eccouncil.org/6-anti-forensic-techniques-that-every-cyber-investigator-dreads/
NEW QUESTION 19
An investigator is analyzing an attack in which malicious files were loaded on the network and were undetected. Several of the images received during the attack include repetitive patterns. Which anti- forensic technique was used?
- A. spoofing
- B. obfuscation
- C. steganography
- D. tunneling
Answer: C
Explanation:
Explanation/Reference: https://doi.org/10.5120/1398-1887
https://www.carbonblack.com/blog/steganography-in-the-modern-attack-landscape/
NEW QUESTION 20
Refer to the exhibit.
Which two determinations should be made about the attack from the Apache access logs? (Choose two.)
- A. The attacker uploaded the word press file manager trojan.
- B. The attacker used the word press file manager plugin to upoad r57.php.
- C. The attacker logged on normally to word press admin page.
- D. The attacker performed a brute force attack against word press and used sql injection against the backend database.
- E. The attacker used r57 exploit to elevate their privilege.
Answer: B,D
NEW QUESTION 21
An "unknown error code" is appearing on an ESXi host during authentication. An engineer checks the authentication logs but is unable to identify the issue. Analysis of the vCenter agent logs shows no connectivity errors. What is the next log file the engineer should check to continue troubleshooting this error?
- A. var/log/shell.log
- B. /var/log/syslog.log
- C. /var/log/vmksummary.log
- D. var/log/general/log
Answer: B
Explanation:
Explanation/Reference: https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.monitoring.doc/GUID-
832A2618-6B11-4A28-9672-93296DA931D0.html
NEW QUESTION 22
A scanner detected a malware-infected file on an endpoint that is attempting to beacon to an external site. An analyst has reviewed the IPS and SIEM logs but is unable to identify the file's behavior. Which logs should be reviewed next to evaluate this file further?
- A. email security appliance
- B. Antivirus solution
- C. network device
- D. DNS server
Answer: D
NEW QUESTION 23
Refer to the exhibit.
An engineer is analyzing a TCP stream in a Wireshark after a suspicious email with a URL. What should be determined about the SMB traffic from this stream?
- A. It is exploiting redirect vulnerability
- B. It is requesting authentication on the user site.
- C. It is redirecting to a malicious phishing website,
- D. It is sharing access to files and printers.
Answer: A
NEW QUESTION 24
Refer to the exhibit.
Which type of code is being used?
- A. Python
- B. BASH
- C. Shell
- D. VBScript
Answer: A
NEW QUESTION 25
A security team received reports of users receiving emails linked to external or unknown URLs that are non- returnable and non-deliverable. The ISP also reported a 500% increase in the amount of ingress and egress email traffic received. After detecting the problem, the security team moves to the recovery phase in their incident response plan. Which two actions should be taken in the recovery phase of this incident? (Choose two.)
- A. scan hosts with updated signatures
- B. verify the breadth of the attack
- C. collect logs
- D. remove vulnerabilities
- E. request packet capture
Answer: A,D
NEW QUESTION 26
A security team detected an above-average amount of inbound tcp/135 connection attempts from unidentified senders. The security team is responding based on their incident response playbook. Which two elements are part of the eradication phase for this incident? (Choose two.)
- A. intrusion prevention system
- B. data and workload isolation
- C. anti-malware software
- D. enterprise block listing solution
- E. centralized user management
Answer: A,E
NEW QUESTION 27
An engineer received a report of a suspicious email from an employee. The employee had already opened the attachment, which was an empty Word document. The engineer cannot identify any clear signs of compromise but while reviewing running processes, observes that PowerShell.exe was spawned by cmd.exe with a grandparent winword.exe process. What is the recommended action the engineer should take?
- A. Investigate the sender of the email and communicate with the employee to determine the motives.
- B. Monitor processes as this a standard behavior of Word macro embedded documents.
- C. Upload the file signature to threat intelligence tools to determine if the file is malicious.
- D. Contain the threat for further analysis as this is an indication of suspicious activity.
Answer: C
NEW QUESTION 28
Drag and drop the capabilities on the left onto the Cisco security solutions on the right.
Answer:
Explanation:
NEW QUESTION 29
A website administrator has an output of an FTP session that runs nightly to download and unzip files to a local staging server. The download includes thousands of files, and the manual process used to find how many files failed to download is time-consuming. The administrator is working on a PowerShell script that will parse a log file and summarize how many files were successfully downloaded versus ones that failed. Which script will read the contents of the file one line at a time and return a collection of objects?
- A. Get-Content-Folder \\Server\FTPFolder\Logfiles\ftpfiles.log | Show-From "ERROR", "SUCCESS"
- B. Get-Content -Path \\Server\FTPFolder\Logfiles\ftpfiles.log | Select-String "ERROR", "SUCCESS"
- C. Get-Content -Directory \\Server\FTPFolder\Logfiles\ftpfiles.log | Export-Result "ERROR", "SUCCESS"
- D. Get-Content -ifmatch \\Server\FTPFolder\Logfiles\ftpfiles.log | Copy-Marked "ERROR", "SUCCESS"
Answer: B
NEW QUESTION 30 
Refer to the exhibit. What should an engineer determine from this Wireshark capture of suspicious network traffic?
- A. There are signs of ARP spoofing, and the engineer should use Static ARP entries and IP address-to- MAC address mappings as a countermeasure.
- B. There are signs of a malformed packet attack, and the engineer should limit the packet size and set a threshold of bytes as a countermeasure.
- C. There are signs of a DNS attack, and the engineer should hide the BIND version and restrict zone transfers as a countermeasure.
- D. There are signs of SYN flood attack, and the engineer should increase the backlog and recycle the oldest half-open TCP connections.
Answer: D
NEW QUESTION 31
An "unknown error code" is appearing on an ESXi host during authentication. An engineer checks the authentication logs but is unable to identify the issue. Analysis of the vCenter agent logs shows no connectivity errors. What is the next log file the engineer should check to continue troubleshooting this error?
- A. var/log/shell.log
- B. /var/log/syslog.log
- C. /var/log/vmksummary.log
- D. var/log/general/log
Answer: B
NEW QUESTION 32
Refer to the exhibit.
An employee notices unexpected changes and setting modifications on their workstation and creates an incident ticket. A support specialist checks processes and services but does not identify anything suspicious. The ticket was escalated to an analyst who reviewed this event log and also discovered that the workstation had multiple large data dumps on network shares. What should be determined from this information?
- A. log tampering
- B. reconnaissance attack
- C. data obfuscation
- D. brute-force attack
Answer: B
NEW QUESTION 33
What are YARA rules based upon?
- A. HTML code
- B. IP addresses
- C. binary patterns
- D. network artifacts
Answer: C
NEW QUESTION 34
An attacker embedded a macro within a word processing file opened by a user in an organization's legal department. The attacker used this technique to gain access to confidential financial dat a. Which two recommendations should a security expert make to mitigate this type of attack? (Choose two.)
- A. firewall rules creation
- B. network access control
- C. signed macro requirements
- D. controlled folder access
- E. removable device restrictions
Answer: C,D
NEW QUESTION 35 
Refer to the exhibit. A security analyst notices unusual connections while monitoring traffic. What is the attack vector, and which action should be taken to prevent this type of event?
- A. DNS spoofing; encrypt communication protocols
- B. SYN flooding, block malicious packets
- C. ARP spoofing; configure port security
- D. MAC flooding; assign static entries
Answer: C
NEW QUESTION 36
......
Conducting Forensic Analysis & Incident Response Using Cisco Technologies for CyberOps Free Update With 100% Exam Passing Guarantee: https://www.testkingpdf.com/300-215-testking-pdf-torrent.html
Real Exam Questions & Answers - Cisco 300-215 Dump is Ready: https://drive.google.com/open?id=1Mp-fxISCc6XJtJk_ZOTkxorVGHrdTHo_
