300-215 Exam Questions

A website administrator has an output of an FTP session that runs nightly to download and unzip files to a local staging server. The download includes thousands of files, and the m...

Refer to the exhibit. An engineer is analyzing a TCP stream in a Wireshark after a suspicious email with a URL. What should be determined about the SMB traffic from this stream?

What is the goal of an incident response plan?

A security team received an alert of suspicious activity on a user's Internet browser. The user's anti- virus software indicated that the file attempted to create a fake recycle bi...

An employee receives an email from a "trusted" person containing a hyperlink that is malvertising. The employee clicks the link and the malware downloads. An information analyst ob...

Refer to the exhibit. Which two actions should be taken based on the intelligence information? (Choose two.)

Refer to the exhibit. Which two determinations should be made about the attack from the Apache access logs? (Choose two.)

A threat actor attempts to avoid detection by turning data into a code that shifts numbers to the right four times. Which anti-forensics technique is being used?

Which technique is used to evade detection from security products by executing arbitrary code in the address space of a separate live operation?

Refer to the exhibit. An HR department submitted a ticket to the IT helpdesk indicating slow performance on an internal share server. The helpdesk engineer checked the server with...

Which magic byte indicates that an analyzed file is a pdf file?

An engineer received a call to assist with an ongoing DDoS attack. The Apache server is being targeted, and availability is compromised. Which step should be taken to identify the...

Refer to the exhibit. What do these artifacts indicate?

Refer to the exhibit. According to the SNORT alert, what is the attacker performing?

Refer to the exhibit. Which type of code created the snippet?

Refer to the exhibit. A security analyst notices unusual connections while monitoring traffic. What is the attack vector, and which action should be taken to prevent this type of e...

Refer to the exhibit. Which two actions should be taken as a result of this information? (Choose two.)

Refer to the exhibit. What should be determined from this Apache log?

Which tool is used for reverse engineering malware?

A scanner detected a malware-infected file on an endpoint that is attempting to beacon to an external site. An analyst has reviewed the IPS and SIEM logs but is unable to identify...

What are YARA rules based upon?

Refer to the exhibit. According to the Wireshark output, what are two indicators of compromise for detecting an Emotet malware download? (Choose two.)

Refer to the exhibit. Which determination should be made by a security analyst?

A security team received reports of users receiving emails linked to external or unknown URLs that are non-returnable and non-deliverable. The ISP also reported a 500% increase in...

An organization uses a Windows 7 workstation for access tracking in one of their physical data centers on which a guard documents entrance/exit activities of all personnel. A serve...

An engineer received a report of a suspicious email from an employee. The employee had already opened the attachment, which was an empty Word document. The engineer cannot identify...

An engineer is analyzing a ticket for an unexpected server shutdown and discovers that the web- server ran out of useable memory and crashed. Which data is needed for further inves...

Refer to the exhibit. An employee notices unexpected changes and setting modifications on their workstation and creates an incident ticket. A support specialist checks processes an...

Refer to the exhibit. A company that uses only the Unix platform implemented an intrusion detection system. After the initial configuration, the number of alerts is overwhelming, a...

Refer to the exhibit. After a cyber attack, an engineer is analyzing an alert that was missed on the intrusion detection system. The attack exploited a vulnerability in a business...

An organization recovered from a recent ransomware outbreak that resulted in significant business damage. Leadership requested a report that identifies the problems that triggered...

Refer to the exhibit. A cybersecurity analyst is presented with the snippet of code used by the threat actor and left behind during the latest incident and is asked to determine it...

A security team is notified from a Cisco ESA solution that an employee received an advertising email with an attached .pdf extension file. The employee opened the attachment, which...

Refer to the exhibit. What is the indicator of compromise?

Which type of record enables forensics analysts to identify fileless malware on Windows machines?

Refer to the exhibit. An engineer received a ticket to analyze a recent breach on a company blog. Every time users visit the blog, they are greeted with a message box. The blog all...

An engineer is analyzing a DoS attack and notices that the perpetrator used a different IP address to hide their system IP address and avoid detection. Which anti-forensics techniq...

An engineer must advise on how YARA rules can enhance detection capabilities. What can YARA rules be used to identify?

Refer to the exhibit. An engineer analyzes an email with a malicious URL that is flagged by Cisco Secure Malware Analytics. The engineer checks the TCP streams and notices that a d...

Snort detects traffic that is targeting vulnerabilities in files that belong to software in the Microsoft Office suite. On a SIEM tool, the SOC analyst sees an alert from Cisco FMC...

An investigator notices that GRE packets are going undetected over the public network. What is occurring?

A security team needs to prevent a remote code execution vulnerability. The vulnerability can be exploited only by sending '${' string in the HTTP request. WAF rule is blocking '${...

An organization experienced a sophisticated phishing attack that resulted in the compromise of confidential information from thousands of user accounts. The threat actor used a lan...

In a secure government communication network, an automated alert indicates the presence of anomalous DLL files injected into the system memory during a routine update of communicat...

Refer to the exhibit. A security analyst notices that a web application running on NGINX is generating an unusual number of log messages. The application is operational and reachab...

A threat intelligence report identifies an outbreak of a new ransomware strain spreading via phishing emails that contain malicious URLs. A compromised cloud service provider, XYZC...

Refer to the exhibit. What is occurring within the exhibit?

An incident responder reviews a log entry that shows a Microsoft Word process initiating an outbound network connection followed by PowerShell execution with obfuscated commands. C...

Refer to the exhibit. An alert came with a potentially suspicious activity from a machine in HR department. Which two IOCs should the security analyst flag? (Choose two.)

A cybersecurity analyst is analyzing a complex set of threat intelligence data from internal and external sources. Among the data, they discover a series of indicators, including p...