300-215 Exam Questions
143 real 300-215 exam questions with expert-verified answers and explanations. Page 3 of 3.
- Question #101Forensics Techniques
A security team receives reports of multiple files causing suspicious activity on users' workstations. The file attempted to access highly confidential information in a centralized...
malware analysissandbox analysisdynamic analysisfile analysis - Question #102Incident Response Techniques
An attacker embedded a macro within a word processing file opened by a user in an organization's legal department. The attacker used this technique to gain access to confidential f...
macro securitymalware mitigationendpoint securityaccess control - Question #103Forensics Techniques
Refer to the exhibit. Which element in this email is an indicator of attack?
indicator of attackemail analysisphishing detectionmalicious attachments - Question #104Forensics Techniques
Refer to the exhibit. Which encoding technique is represented by this HEX string?
encodinghexadecimaldata formatscharcode - Question #105Incident Response Techniques
A network host is infected with malware by an attacker who uses the host to make calls for files and shuttle traffic to bots. This attack went undetected and resulted in a signific...
network securityC2 detectionmalware protectionfirewall - Question #106Forensics Techniques
What is a use of TCPdump?
TCPdumpnetwork analysispacket capture - Question #107Incident Response Processes
An incident response team is recommending changes after analyzing a recent compromise in which: - a large number of events and logs were involved; - team members were not able to i...
incident response processpost-incident reviewplaybook improvementlog management - Question #108Forensics Techniques
Which information is provided about the object file by the "-h" option in the objdump line command objdump 璪 oasys 璵 vax 環 fu.o?
objdumpcommand-line toolsbinary analysisfile headers - Question #109Forensics Techniques
Refer to the exhibit. An engineer is analyzing a .LNK (shortcut) file recently received as an email attachment and blocked by email security as suspicious. What is the next step an...
malware analysisLNK filessandbox analysisemail security - Question #110Forensics Techniques
An investigator is analyzing an attack in which malicious files were loaded on the network and were undetected. Several of the images received during the attack include repetitive...
steganographyanti-forensicsimage analysisdata concealment - Question #111Incident Response Processes
A security team detected an above-average amount of inbound tcp/135 connection attempts from unidentified senders. The security team is responding based on their incident response...
incident response phaseseradicationcontainmentnetwork security controls - Question #112Forensics Techniques
Which tool conducts memory analysis?
memory forensicsVolatilityforensic tools - Question #114Forensics Techniques
Refer to the exhibit. Which type of code is being used?
scripting languagescode analysisPythonstatic analysis - Question #115Forensics Techniques
What is the function of a disassembler?
disassemblerstatic analysismalware analysisreverse engineering - Question #116Forensics Techniques
An "unknown error code" is appearing on an ESXi host during authentication. An engineer checks the authentication logs but is unable to identify the issue. Analysis of the vCenter...
log analysistroubleshootingESXiauthentication errors - Question #117Forensics Techniques
Over the last year, an organization's HR department has accessed data from its legal department on the last day of each month to create a monthly activity report. An engineer is an...
insider threatdata exfiltrationbehavioral analysisthreat actor identification - Question #118Forensics Techniques
An endpoint shows suspicious PowerShell activity, but no malicious files are found on disk. What evidence source is MOST likely to reveal the attacker's actions?
memory forensicsPowerShell forensicsvolatile memoryfileless malware - Question #119Forensics Processes
An analyst calculates hashes before and after imaging a hard drive. The hashes do not match. What does this MOST likely indicate?
forensic imagingdata integrityhashingevidence tampering - Question #120Forensics Techniques
Which Windows artifact BEST helps identify persistence via scheduled tasks?
Windows forensicsScheduled tasksPersistenceArtifact analysis - Question #121Fundamentals
An attacker gains access using stolen credentials but never executes malware. Which type of attack is this?
Attack typesLiving-off-the-landCredential theftEvasion - Question #122Incident Response Techniques
Which step should occur IMMEDIATELY after identifying ransomware actively encrypting files on multiple hosts?
Incident responseRansomwareContainmentSystem isolation - Question #123Forensics Techniques
Which indicator BEST distinguishes malware command-and-control (C2) traffic from normal outbound traffic?
Network forensicsC2 trafficBeaconingTraffic analysis - Question #124Forensics Techniques
An investigator finds evidence erased from disk but suspects prior existence. Which artifact is MOST likely to retain evidence?
Data recoveryWindows forensicsPage fileDeleted data - Question #125Forensics Processes
Why is time synchronization CRITICAL during forensic analysis?
Forensic principlesTime synchronizationEvent correlationEvidence integrity - Question #126Forensics Processes
Which action BEST supports legal admissibility of digital evidence?
Digital evidenceChain of custodyLegal admissibilityForensic processes - Question #127Incident Response Techniques
Which Cisco capability allows analysts to determine when a file became malicious AFTER it was initially allowed?
Cisco securityRetrospective securityFile reputationThreat detection - Question #128Forensics Techniques
Refer to the exhibit. Which type of code does this snippet represent?
Code analysisScriptingPythonUser management - Question #129Fundamentals
An attacker modifies a malicious file named TOPSECRET0123456789 by changing its file extension from a .png to a .doc in an attempt to evade detection. Which technique is being used...
Evasion techniquesFile masqueradingSpoofingMalware disguise - Question #130Forensics Techniques
Refer to the exhibit. Which registry key is suspected to be used by an attacker to establish persistence?
Windows forensicsRegistry analysisPersistence mechanismsAttacker techniques - Question #131Forensics Techniques
Refer to the exhibit. An experienced cybersecurity analyst is investigating a sophisticated suspected breach on a Windows server within an enterprise network and compiled the evide...
Incident investigationMemory forensicsScope and impactBreach analysis - Question #132Forensics Techniques
Refer to the exhibit. A cybersecurity analyst must analyze the logs from an Apache server for the client. The concern is that an offboarded employee home IP address was potentially...
Log analysisApache logsWeb server forensicsVPN access - Question #133Forensics Techniques
The Linux system administrator of a company suspects that physical unauthorized access was granted to a local Linux terminal. The administrator wants to examine the suspected machi...
Linux forensicsUser accountsPassword hashesSystem files - Question #134Forensics Techniques
A threat hunter must analyze the threat intelligence report on APT29 and identify whether the threat actor is on the Windows machines of the customer network. According to the repo...
Threat huntingAPTC2 detectionLog analysis - Question #135Forensics Techniques
Refer to the exhibit. During a static analysis of the potentially malicious executable obpdisp.exe, a SOC analyst identifies several functions of the executable. The analyst must c...
Malware analysisStatic analysisDynamic analysisThreat assessment - Question #136Incident Response Techniques
A cybersecurity analyst must evaluate files from an endpoint in an enterprise network. The antivirus software on the endpoint flagged a suspicious file during a routine scan. On in...
Malware analysisUnknown threatsThreat intelligenceIncident response - Question #137Fundamentals
Which technique exemplifies an antiforensic technique?
Anti-forensicsSteganographyData hidingEvasion - Question #138Forensics Techniques
What is the purpose of YARA rules in malware analysis and how do the rules aid in identifying, classifying, and documenting malware?
Malware analysisYARA rulesPattern matchingStatic analysis - Question #139Forensics Techniques
Refer to the exhibit. The company was taken over by a larger one, and the IT Security team was brought in to evaluate the security architecture and setup. After the information col...
Windows forensicsCompromised filesMalicious DLLsPost-breach analysis - Question #140Incident Response Techniques
During an overnight shift, a cybersecurity team at a global trading firm detects irregular activity. The network intrusion system flags an encrypted traffic spike from high-value t...
Incident detectionTraffic analysisData exfiltrationTor - Question #141Incident Response Techniques
A security analyst receives a notification from SIEM that an internal host has active connections to Tor exit nodes. The analyst investigates SIEM events related to the workstation...
SIEM alertsTor detectionPort scanningNetwork mitigationNGFW - Question #142Forensics Techniques
During a recent incident response investigation, several suspicious network connections originating from a specific host were identified. The host was quickly isolated and the mach...
Network forensicsLog analysisIncident post-mortemData correlation - Question #143Forensics Techniques
Which issue is associated with gathering evidence from virtualized environments provided by major cloud vendors?
Cloud forensicsVirtualized environmentsEvidence gatheringMultitenancy - Question #144Incident Response Processes
A financial company handling international transactions recently experienced a complex security incident. The incident involves simultaneous DDoS attacks, suspected internal data l...
Incident playbookDDoS mitigationData leakageMalware response