Scribd Logo
Upload

Welcome to Scribd!

    • 10 views

    Updated ICisco 300-215 Exam Questions (2024)

    Uploaded by

    upx7ebbsyalc
    The document discusses a Cisco 300-215 exam with questions and answers on conducting forensic analysis and incident response using Cisco CyberOps technologies. It includes six multiple choice questions about lessons learned from a security breach, investigating suspicious network traffic, identifying an HTTP request that downloaded malware, concerns around public cloud forensics, and searching log files for an IP address.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Updated ICisco 300-215 Exam Questions (2024)

    Uploaded by

    upx7ebbsyalc
    10 views8 pages
    The document discusses a Cisco 300-215 exam with questions and answers on conducting forensic analysis and incident response using Cisco CyberOps technologies. It includes six multiple choice questions about lessons learned from a security breach, investigating suspicious network traffic, identifying an HTTP request that downloaded malware, concerns around public cloud forensics, and searching log files for an IP address.

    Original Description:

    Cisco 300-215 exams are not easy to pass with just book reading. Taking the exams requires understanding all levels of exams before you attempt them.. If you want to pass Cisco 300-215 exams and looking for best and easy to understand Cisco 300-215 dumps so, now it is very easy for you to get it at CertCollections. We have real Cisco 300-215 exam questions available for all Cisco 300-215 exams with their answers and we are providing it with 100% exam passing and money back guarantee. We are pres

    Original Title

    Updated ICisco 300-215 Exam Questions [2024]

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses a Cisco 300-215 exam with questions and answers on conducting forensic analysis and incident response using Cisco CyberOps technologies. It includes six multiple choice questions about lessons learned from a security breach, investigating suspicious network traffic, identifying an HTTP request that downloaded malware, concerns around public cloud forensics, and searching log files for an IP address.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    10 views8 pages

    Updated ICisco 300-215 Exam Questions (2024)

    Uploaded by

    upx7ebbsyalc
    The document discusses a Cisco 300-215 exam with questions and answers on conducting forensic analysis and incident response using Cisco CyberOps technologies. It includes six multiple choice questions about lessons learned from a security breach, investigating suspicious network traffic, identifying an HTTP request that downloaded malware, concerns around public cloud forensics, and searching log files for an IP address.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 8

    Cisco

    300-215
    Questions & Answers
    Conducting Forensic Analysis and Incident Response Using
    Cisco CyberOps Technologies

    (Demo Version - Limited Content)


    Questions & Answers PDF Page 2

    Version: 4.0

    Question: 1

    A security team is discussing lessons learned and suggesting process changes after a security breach
    incident. During the incident, members of the security team failed to report the abnormal system
    activity due to a high project workload. Additionally, when the incident was identified, the response
    took six hours due to management being unavailable to provide the approvals needed. Which two
    steps will prevent these issues from occurring in the future? (Choose two.)

    A. Introduce a priority rating for incident response workloads.

    B. Provide phishing awareness training for the fill security team.


    C. Conduct a risk audit of the incident response workflow.

    D. Create an executive team delegation plan.

    E. Automate security alert timeframes with escalation triggers.

    Answer: AE

    Question: 2

    An engineer is investigating a ticket from the accounting department in which a user discovered an
    unexpected application on their workstation. Several alerts are seen from the intrusion detection
    system of unknown outgoing internet traffic from this workstation. The engineer also notices a
    degraded processing capability, which complicates the analysis process. Which two actions should
    the engineer take? (Choose two.)

    A. Restore to a system recovery point.

    https://www.certcollections.com
    http://www.justcerts.com
    Questions & Answers PDF Page 3

    B. Replace the faulty CPU.

    C. Disconnect from the network.

    D. Format the workstation drives.

    E. Take an image of the workstation.

    Answer: AE

    Question: 3

    Refer to the exhibit.

    What should an engineer determine from this Wireshark capture of suspicious network traffic?

    A. There are signs of SYN flood attack, and the engineer should increase the backlog and recycle the
    oldest half-open TCP connections.
    B. There are signs of a malformed packet attack, and the engineer should limit the packet size and set
    a threshold of bytes as a countermeasure.
    C. There are signs of a DNS attack, and the engineer should hide the BIND version and restrict zone
    transfers as a countermeasure.

    https://www.certcollections.com
    http://www.justcerts.com
    Questions & Answers PDF Page 4

    D. There are signs of ARP spoofing, and the engineer should use Static ARP entries and IP address-to-
    MAC address mappings as a countermeasure.

    Answer: A

    Question: 4

    Refer to the exhibit.

    A network engineer is analyzing a Wireshark file to determine the HTTP request that caused the
    initial Ursnif banking Trojan binary to download. Which filter did the engineer apply to sort the
    Wireshark traffic logs?

    A. http.request.un matches
    B. tls.handshake.type ==1
    C. tcp.port eq 25
    D. tcp.window_size ==0

    https://www.certcollections.com
    http://www.justcerts.com
    Questions & Answers PDF Page 5

    Answer: B

    Reference:
    https://www.malware-traffic-analysis.net/2018/11/08/index.html
    https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-ursnif-infections/

    Question: 5

    What is a concern for gathering forensics evidence in public cloud environments?

    A. High Cost: Cloud service providers typically charge high fees for allowing cloud forensics.
    B. Configuration: Implementing security zones and proper network segmentation.
    C. Timeliness: Gathering forensics evidence from cloud service providers typically requires
    substantial time.
    D. Multitenancy: Evidence gathering must avoid exposure of data from other tenants.

    Answer: D

    Reference: https://www.researchgate.net/
    publication/307871954_About_Cloud_Forensics_Challenges_and_Solutions

    Question: 6

    Which scripts will search a log file for the IP address of 192.168.100.100 and create an output file
    named parsed_host.log while printing results to the console?

    https://www.certcollections.com
    http://www.justcerts.com
    Questions & Answers PDF Page 6

    https://www.certcollections.com
    http://www.justcerts.com
    Questions & Answers PDF Page 7

    A. Option A

    B. Option B

    C. Option C

    D. Option D

    Answer: A

    https://www.certcollections.com
    http://www.justcerts.com
    Thank you for trying
    Our 300-215 Exam Dumps PDF Demo

    Try 300-215 practice question


    If you want to try 300-215 Exam
    Practice Test Questions So go to below
    link and try it!

    https://www.certcollections.com/300-215-exam-
    questions

    You might also like