300-215 Exam Dumps - Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

Question # 4

Refer to the exhibit.

Which type of code created the snippet?

VB Script

Python

PowerShell

Bash Script

Full Access

Question # 5

Refer to the exhibit.

An employee notices unexpected changes and setting modifications on their workstation and creates an incident ticket. A support specialist checks processes and services but does not identify anything suspicious. The ticket was escalated to an analyst who reviewed this event log and also discovered that the workstation had multiple large data dumps on network shares. What should be determined from this information?

data obfuscation

reconnaissance attack

brute-force attack

log tampering

Full Access

Question # 6

A security team is discussing lessons learned and suggesting process changes after a security breach incident. During the incident, members of the security team failed to report the abnormal system activity due to a high project workload. Additionally, when the incident was identified, the response took six hours due to management being unavailable to provide the approvals needed. Which two steps will prevent these issues from occurring in the future? (Choose two.)

Introduce a priority rating for incident response workloads.

Provide phishing awareness training for the fill security team.

Conduct a risk audit of the incident response workflow.

Create an executive team delegation plan.

Automate security alert timeframes with escalation triggers.

Full Access

Question # 7

Refer to the exhibit.

Which two actions should be taken based on the intelligence information? (Choose two.)

Block network access to all .shop domains

Add a SIEM rule to alert on connections to identified domains.

Use the DNS server to block hole all .shop requests.

Block network access to identified domains.

Route traffic from identified domains to block hole.

Full Access

Question # 8

Refer to the exhibit.

A network engineer is analyzing a Wireshark file to determine the HTTP request that caused the initial Ursnif banking Trojan binary to download. Which filter did the engineer apply to sort the Wireshark traffic logs?

http.request.un matches

tls.handshake.type ==1

tcp.port eq 25

tcp.window_size ==0

Full Access