nerdexam
Cisco

300-215 · Question #134

A threat hunter must analyze the threat intelligence report on APT29 and identify whether the threat actor is on the Windows machines of the customer network. According to the report, the user…

The correct answer is B. PowerShell logs D. DNS logs. DNS logs are required to detect and validate C2 activity over port 53 by revealing suspicious query patterns, domains, and resolution behavior consistent with DNS-based command-and- control. PowerShell logs capture the CLI-driven post-compromise activity on Windows (script…

Submitted by hans_de· Mar 6, 2026Forensics Techniques

Question

A threat hunter must analyze the threat intelligence report on APT29 and identify whether the threat actor is on the Windows machines of the customer network. According to the report, the user executes a malicious file on the victim machine that establishes a C2 connection over port 53. Afterward, the attacker uses a CLI to stage and exfiltrate business data. Which two types of logs enable the threat hunter to accomplish the task? (Choose two.)

Options

  • Afile integrity monitoring logs
  • BPowerShell logs
  • CNetFlow logs
  • DDNS logs
  • Eweb application firewall logs

How the community answered

(55 responses)
  • A
    5% (3)
  • B
    60% (33)
  • C
    11% (6)
  • E
    24% (13)

Explanation

DNS logs are required to detect and validate C2 activity over port 53 by revealing suspicious query patterns, domains, and resolution behavior consistent with DNS-based command-and- control. PowerShell logs capture the CLI-driven post-compromise activity on Windows (script block/module/transcription evidence), helping confirm staging and exfiltration commands and tie them to user context and execution timelines.

Topics

#Threat hunting#APT#C2 detection#Log analysis

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-215 Practice