Free 300-215 – Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR) Practice Test Question

Answer is in the explanation below.

Select all that apply, then click Submit answer.

• ○

  Restore to a system recovery point.

• ○

  Replace the faulty CPU.

• ○

  Disconnect from the network.

• ○

  Format the workstation drives.

• ○

  Take an image of the workstation.
  
  

Select all that apply, then click Submit answer.

• ○

  Block network access to all .shop domains

• ○

  Add a SIEM rule to alert on connections to identified domains.

• ○

  Use the DNS server to block hole all .shop requests.

• ○

  Block network access to identified domains.

• ○

  Route traffic from identified domains to block hole.
  
  

Select all that apply, then click Submit answer.

• ○

  Formalize reporting requirements and responsibilities to update management and internal stakeholders throughout the incident-handling process effectively.

• ○

  Improve the mitigation phase to ensure causes can be quickly identified, and systems returned to a functioning state.

• ○

  Implement an automated operation to pull systems events/logs and bring them into an organizational context.

• ○

  Allocate additional resources for the containment phase to stabilize systems in a timely manner and reduce an attack’s breadth.

• ○

  Modify the incident handling playbook and checklist to ensure alignment and agreement on roles, responsibilities, and steps before an incident occurs.
  
  

Select all that apply, then click Submit answer.

• ○

  verify the breadth of the attack

• ○

  collect logs

• ○

  request packet capture

• ○

  remove vulnerabilities

• ○

  scan hosts with updated signatures
  
  

Select an option, then click Submit answer.

• ○

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon

• ○

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ProfileList

• ○

  HKEY_CURRENT_USER\Software\Classes\Winlog

• ○

  HKEY_LOCAL_MACHINES\SOFTWARE\Microsoft\WindowsNT\CurrentUser
  
  

Select an option, then click Submit answer.

• ○

  hiding a section of a malicious file in unused areas of a file

• ○

  changing the file header of a malicious file to another file type

• ○

  sending malicious files over a public network by encapsulation

• ○

  concealing malicious files in ordinary or unsuspecting places
  
  

Select an option, then click Submit answer.

• ○

  A module named mod_ssl is needed to make SSL connections.

• ○

  The private key does not match with the SSL certificate.

• ○

  The certificate file has been maliciously modified

• ○

  The SSL traffic setup is improper
  
  

Select an option, then click Submit answer.

• ○

  An executable file is requesting an application download.

• ○

  A malicious file is redirecting users to different domains.

• ○

  The MD5 of a file is identified as a virus and is being blocked.

• ○

  A forged DNS request is forwarding users to malicious websites.
  
  

Select an option, then click Submit answer.

• ○

  Upload the file signature to threat intelligence tools to determine if the file is malicious.

• ○

  Monitor processes as this a standard behavior of Word macro embedded documents.

• ○

  Contain the threat for further analysis as this is an indication of suspicious activity.

• ○

  Investigate the sender of the email and communicate with the employee to determine the motives.