300-215 Exam Questions & Answers
Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity • Cisco
100% money-back guarantee
Sample 300-215 Questions
Practice with real exam-style questions, each with the verified correct answer and explanation.
An engineer is investigating a ticket from the accounting department in which a user discovered an unexpected application on their workstation. Several alerts are seen from the intrusion detection system of unknown outgoing internet traffic from this workstation. The engineer also notices a degraded processing capability, which complicates the analysis process. Which two actions should the engineer take? (Choose two.)
When suspicious activity is detected on a workstation, immediate steps need to be taken to preserve evidence and prevent further compromise:
Disconnecting the system from the network (C) is crucial to stop potential exfiltration of data or ongoing communications with a command-and-control server. This isolation prevents further spread or damage while preserving the state of the compromised system for further investigation.
Taking an image of the workstation (E) is part of the forensics acquisition process. It involves creating a bit-by-bit copy of the system's disk, which preserves all evidence in its current state. This allows for thorough forensic analysis without affecting the original evidence.
These steps align with the best practices outlined in the incident response and forensics processes (as described in the CyberOps Technologies (CBRFIR) 300-215 study guide). Specifically, in the Identification and Containment phases of the incident response cycle, it's emphasized that isolating the system and preserving evidence through imaging are critical to ensuring both containment of the threat and successful forensic investigation.
What is an issue with digital forensics in cloud environments, from a security point of view?
One of the primary challenges of cloud forensics is the inability to physically access the underlying hardware (e.g., the hard drives storing VM or container data). This restricts investigators from performing traditional disk imaging and handling procedures, which are crucial for maintaining evidence integrity. This limitation is widely recognized in cloud forensics frameworks.
Correct answer: C. no physical access to the hard drive.
A new zero-day vulnerability is discovered in the web application. Vulnerability does not require physical access and can be exploited remotely. Attackers are exploiting the new vulnerability by submitting a form with malicious content that grants them access to the server. After exploitation, attackers delete the log files to hide traces. Which two actions should the security engineer take next? (Choose two.)
Input validation (A) is a critical countermeasure to defend against command injection and related vulnerabilities, as discussed in the Cisco guide. Proper validation ensures that malicious commands or payloads are not accepted or executed by the web application.
File integrity monitoring (E) helps detect unauthorized changes such as log deletion or binary modification, making it a crucial tool in recognizing and investigating tampering attempts.Blocking port 443 (B) would disable HTTPS and is not a practical solution. Antivirus (C) does not prevent form-based application attacks, and merely updating the application (D) may not be sufficient without addressing the underlying input validation flaw.
---
A workstation uploads encrypted traffic to a known clean domain over TCP port 80. What type of attack is occurring, according to the MITRE ATT&CK matrix?
According to the MITRE ATT&CK matrix, when encrypted traffic is tunneled through a legitimate protocol such as HTTP (port 80) to a non-malicious domain, this aligns with the tactic ''Exfiltration Over Asymmetric Encrypted Non-C2 Protocol'' (T1048.002). The attacker is trying to hide exfiltration in otherwise benign traffic.
An organization fell victim to a ransomware attack that successfully infected 256 hosts within its network. In the aftermath of this incident, the organization's cybersecurity team must prepare a thorough root cause analysis report. This report aims to identify the primary factor or factors that led to the successful ransomware attack and to develop strategies for preventing similar incidents in the future. In this context, what should the cybersecurity engineer include in the root cause analysis report to demonstrate the underlying cause of the incident?
According to the Cisco CyberOps Associate guide, the goal of a root cause analysis is to determine how an attacker successfully exploited a system so that similar vulnerabilities can be mitigated in the future. The 'method of infection' (e.g., phishing email with malicious attachment, drive-by download, credential compromise, etc.) is the most relevant factor in understanding the initial access vector and subsequent spread of ransomware across the network.
---
Get access to all 131 verified questions with detailed answers.
Unlock All 300-215 Questions