Question 1

Refer to the exhibit. According to the Wireshark output, what are two indicators of compromise for detecting an Emotet malware download? (Choose two.)

Accepted Answer

A)   Domain name:iraniansk.com
B)   Server: nginx
C)   Hash value: 5f31ab113af08=1597090577
D)   filename= "Fy.exe"
E)   Content-Type: application/octet-streamF) B) and C)
G) D) and E)

Question 2

A security team is discussing lessons learned and suggesting process changes after a security breach incident. During the incident, members of the security team failed to report the abnormal system activity due to a high project workload. Additionally, when the incident was identified, the response took six hours due to management being unavailable to provide the approvals needed. Which two steps will prevent these issues from occurring in the future? (Choose two.)

Accepted Answer

A)   Introduce a priority rating for incident response workloads.
B)   Provide phishing awareness training for the fill security team.
C)   Conduct a risk audit of the incident response workflow.
D)   Create an executive team delegation plan.
E)   Automate security alert timeframes with escalation triggers.F) A) and D)
G) B) and E)

Question 3

Which information is provided bout the object file by the "-h" option in the objdump line command objdump -b oasys -m vax -h fu.o ?

Accepted Answer

A)   bfdname
B)   debugging
C)   help
D)   headersE) B) and C)
F) A) and B)

Question 4

A website administrator has an output of an FTP session that runs nightly to download and unzip files to a local staging server. The download includes thousands of files, and the manual process used to find how many files failed to download is time-consuming. The administrator is working on a PowerShell script that will parse a log file and summarize how many files were successfully downloaded versus ones that failed. Which script will read the contents of the file one line at a time and return a collection of objects?

Accepted Answer

A)   Get-Content-Folder \Server\FTPFolder\Logfiles\ftpfiles.log | Show-From "ERROR", "SUCCESS"
B)   Get-Content -ifmatch \Server\FTPFolder\Logfiles\ftpfiles.log | Copy-Marked "ERROR", "SUCCESS"
C)   Get-Content -Directory \Server\FTPFolder\Logfiles\ftpfiles.log | Export-Result "ERROR", "SUCCESS"
D)   Get-Content -Path \Server\FTPFolder\Logfiles\ftpfiles.log | Select-String "ERROR", "SUCCESS"E) All of the above
F) B) and D)

Question 5

Which technique is used to evade detection from security products by executing arbitrary code in the address space of a separate live operation?

Accepted Answer

A)   process injection
B)   privilege escalation
C)   GPO modification
D)   token manipulationE) A) and B)
F) A) and C)

Question 6

Refer to the exhibit. What should be determined from this Apache log?

Accepted Answer

A)   A module named mod_ssl is needed to make SSL connections.
B)   The private key does not match with the SSL certificate.
C)   The certificate file has been maliciously modified
D)   The SSL traffic setup is improperE) A) and B)
F) B) and C)

Question 7

Refer to the exhibit. A network engineer is analyzing a Wireshark file to determine the HTTP request that caused the initial Ursnif banking Trojan binary to download. Which filter did the engineer apply to sort the Wireshark traffic logs?

Accepted Answer

A)   http.request.un matches
B)   tls.handshake.type ==1
C)   tcp.port eq 25
D)   tcp.window_size ==0E) A) and C)
F) A) and B)

Question 8

What is the function of a disassembler?

Accepted Answer

A)   aids performing static malware analysis
B)   aids viewing and changing the running state
C)   aids transforming symbolic language into machine code
D)   aids defining breakpoints in program executionE) B) and C)
F) A) and D) A

Question 9

A security team received an alert of suspicious activity on a user's Internet browser. The user's anti-virus software indicated that the file attempted to create a fake recycle bin folder and connect to an external IP address. Which two actions should be taken by the security analyst with the executable file for further analysis? (Choose two.)

Accepted Answer

A)   Evaluate the process activity in Cisco Umbrella.
B)   Analyze the TCP/IP Streams in Cisco Secure Malware Analytics (Threat Grid) .
C)   Evaluate the behavioral indicators in Cisco Secure Malware Analytics (Threat Grid) .
D)   Analyze the Magic File type in Cisco Umbrella.
E)   Network Exit Localization in Cisco Secure Malware Analytics (Threat Grid) .F) A) and B)
G) C) and D)

Question 10

Refer to the exhibit. Which two actions should be taken based on the intelligence information? (Choose two.)

Accepted Answer

A)   Block network access to all .shop domains
B)   Add a SIEM rule to alert on connections to identified domains.
C)   Use the DNS server to block hole all .shop requests.
D)   Block network access to identified domains.
E)   Route traffic from identified domains to block hole.F) A) and B)
G) B) and D)

Question 11

A scanner detected a malware-infected file on an endpoint that is attempting to beacon to an external site. An analyst has reviewed the IPS and SIEM logs but is unable to identify the file's behavior. Which logs should be reviewed next to evaluate this file further?

Accepted Answer

A)   email security appliance
B)   DNS server
C)   Antivirus solution
D)   network deviceE) B) and D)
F) A) and D)

Question 12

An attacker embedded a macro within a word processing file opened by a user in an organization's legal department. The attacker used this technique to gain access to confidential financial data. Which two recommendations should a security expert make to mitigate this type of attack? (Choose two.)

Accepted Answer

A)   controlled folder access
B)   removable device restrictions
C)   signed macro requirements
D)   firewall rules creation
E)   network access controlF) C) and E)
G) D) and E) A,C

Question 13

Refer to the exhibit. A security analyst notices unusual connections while monitoring traffic. What is the attack vector, and which action should be taken to prevent this type of event?

Accepted Answer

A)   DNS spoofing; encrypt communication protocols
B)   SYN flooding, block malicious packets
C)   ARP spoofing; configure port security
D)   MAC flooding; assign static entriesE) None of the above
F) All of the above

Question 14

An "unknown error code" is appearing on an ESXi host during authentication. An engineer checks the authentication logs but is unable to identify the issue. Analysis of the vCenter agent logs shows no connectivity errors. What is the next log file the engineer should check to continue troubleshooting this error?

Accepted Answer

A)   /var/log/syslog.log
B)   /var/log/vmksummary.log
C)   var/log/shell.log
D)   var/log/general/logE) None of the above
F) B) and C)

Question 15

Which scripts will search a log file for the IP address of 192.168.100.100 and create an output file named parsed_host.log while printing results to the console?

Accepted Answer

A)   
B)   
C)   
D)   E) B) and C)
F) None of the above A

Question 16

Refer to the exhibit. An engineer is analyzing a TCP stream in a Wireshark after a suspicious email with a URL. What should be determined about the SMB traffic from this stream?

Accepted Answer

A)   It is redirecting to a malicious phishing website,
B)   It is exploiting redirect vulnerability
C)   It is requesting authentication on the user site.
D)   It is sharing access to files and printers.E) C) and D)
F) A) and C)

Question 17

Refer to the exhibit. Which encoding technique is represented by this HEX string?

Accepted Answer

A)   Unicode
B)   Binary
C)   Base64
D)   CharcodeE) A) and B)
F) B) and C)

Question 18

An engineer received a call to assist with an ongoing DDoS attack. The Apache server is being targeted, and availability is compromised. Which step should be taken to identify the origin of the threat?

Accepted Answer

A)   An engineer should check the list of usernames currently logged in by running the command $ who | cut -d' ' -f1| sort | uniq An engineer should check the list of usernames currently logged in by running the command $ who | cut -d' ' -f1| sort | uniq
B)   An engineer should check the server's processes by running commands ps -aux and sudo ps -a . An engineer should check the server's processes by running commands ps -aux and sudo ps -a .
C)   An engineer should check the services on the machine by running the command service -status-all . An engineer should check the services on the machine by running the command service -status-all
D)   An engineer should check the last hundred entries of a web server with the command sudo tail -100 /var/log/apache2/access.log . An engineer should check the last hundred entries of a web server with the command sudo tail -100 /var/log/apache2/access.logE) B) and C)
F) A) and D)

Question 19

A security team receives reports of multiple files causing suspicious activity on users' workstations. The file attempted to access highly confidential information in a centralized file server. Which two actions should be taken by a security analyst to evaluate the file in a sandbox? (Choose two.)

Accepted Answer

A)   Inspect registry entries
B)   Inspect processes.
C)   Inspect file hash.
D)   Inspect file type.
E)   Inspect PE header.F) All of the above
G) A) and B)

Question 20

Refer to the exhibit. What is the IOC threat and URL in this STIX JSON snippet?

Accepted Answer

A)   malware; 'http://x4z9arb.cn/4712/'
B)   malware; x4z9arb backdoor
C)   x4z9arb backdoor; http://x4z9arb.cn/4712/
D)   malware; malware--162d917e-766f-4611-b5d6-652791454fca
E)   stix; 'http://x4z9arb.cn/4712/'F) A) and C)
G) D) and E)

Exam 7: Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

Refer to the exhibit. According to the Wireshark output, what are two indicators of compromise for detecting an Emotet malware download? (Choose two.)

Correct Answer
verified

Correct Answer
verified

Which information is provided bout the object file by the "-h" option in the objdump line command objdump -b oasys -m vax -h fu.o ?

Correct Answer
verified

Correct Answer
verified

Which technique is used to evade detection from security products by executing arbitrary code in the address space of a separate live operation?

Correct Answer
verified

Refer to the exhibit. What should be determined from this Apache log?

Correct Answer
verified

Refer to the exhibit. A network engineer is analyzing a Wireshark file to determine the HTTP request that caused the initial Ursnif banking Trojan binary to download. Which filter did the engineer apply to sort the Wireshark traffic logs?

Correct Answer
verified

What is the function of a disassembler?

Correct Answer
verified
A

Correct Answer
verified

Refer to the exhibit. Which two actions should be taken based on the intelligence information? (Choose two.)

Correct Answer
verified

A scanner detected a malware-infected file on an endpoint that is attempting to beacon to an external site. An analyst has reviewed the IPS and SIEM logs but is unable to identify the file's behavior. Which logs should be reviewed next to evaluate this file further?

Correct Answer
verified

An attacker embedded a macro within a word processing file opened by a user in an organization's legal department. The attacker used this technique to gain access to confidential financial data. Which two recommendations should a security expert make to mitigate this type of attack? (Choose two.)

Correct Answer
verified
A,C

Refer to the exhibit. A security analyst notices unusual connections while monitoring traffic. What is the attack vector, and which action should be taken to prevent this type of event?

Correct Answer
verified

Correct Answer
verified

Which scripts will search a log file for the IP address of 192.168.100.100 and create an output file named parsed_host.log while printing results to the console?

Correct Answer
verified
A

Refer to the exhibit. An engineer is analyzing a TCP stream in a Wireshark after a suspicious email with a URL. What should be determined about the SMB traffic from this stream?

Correct Answer
verified

Refer to the exhibit. Which encoding technique is represented by this HEX string?

Correct Answer
verified

An engineer received a call to assist with an ongoing DDoS attack. The Apache server is being targeted, and availability is compromised. Which step should be taken to identify the origin of the threat?

Correct Answer
verified

A security team receives reports of multiple files causing suspicious activity on users' workstations. The file attempted to access highly confidential information in a centralized file server. Which two actions should be taken by a security analyst to evaluate the file in a sandbox? (Choose two.)

Correct Answer
verified

Refer to the exhibit. What is the IOC threat and URL in this STIX JSON snippet?

Correct Answer
verified

Exam 7: Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

Refer to the exhibit. According to the Wireshark output, what are two indicators of compromise for detecting an Emotet malware download? (Choose two.)

Correct AnswerverifiedShow Answer

Correct AnswerverifiedShow Answer

Which information is provided bout the object file by the "-h" option in the objdump line command objdump -b oasys -m vax -h fu.o ?

Correct AnswerverifiedShow Answer

Correct AnswerverifiedShow Answer

Which technique is used to evade detection from security products by executing arbitrary code in the address space of a separate live operation?

Correct AnswerverifiedShow Answer

Refer to the exhibit. What should be determined from this Apache log?

Correct AnswerverifiedShow Answer

Refer to the exhibit. A network engineer is analyzing a Wireshark file to determine the HTTP request that caused the initial Ursnif banking Trojan binary to download. Which filter did the engineer apply to sort the Wireshark traffic logs?

Correct AnswerverifiedShow Answer

What is the function of a disassembler?

Correct AnswerverifiedA

Correct AnswerverifiedShow Answer

Refer to the exhibit. Which two actions should be taken based on the intelligence information? (Choose two.)

Correct AnswerverifiedShow Answer

A scanner detected a malware-infected file on an endpoint that is attempting to beacon to an external site. An analyst has reviewed the IPS and SIEM logs but is unable to identify the file's behavior. Which logs should be reviewed next to evaluate this file further?

Correct AnswerverifiedShow Answer

An attacker embedded a macro within a word processing file opened by a user in an organization's legal department. The attacker used this technique to gain access to confidential financial data. Which two recommendations should a security expert make to mitigate this type of attack? (Choose two.)

Correct AnswerverifiedA,C

Refer to the exhibit. A security analyst notices unusual connections while monitoring traffic. What is the attack vector, and which action should be taken to prevent this type of event?

Correct AnswerverifiedShow Answer

Correct AnswerverifiedShow Answer

Which scripts will search a log file for the IP address of 192.168.100.100 and create an output file named parsed_host.log while printing results to the console?

Correct AnswerverifiedA

Refer to the exhibit. An engineer is analyzing a TCP stream in a Wireshark after a suspicious email with a URL. What should be determined about the SMB traffic from this stream?

Correct AnswerverifiedShow Answer

Refer to the exhibit. Which encoding technique is represented by this HEX string?

Correct AnswerverifiedShow Answer

An engineer received a call to assist with an ongoing DDoS attack. The Apache server is being targeted, and availability is compromised. Which step should be taken to identify the origin of the threat?

Correct AnswerverifiedShow Answer

A security team receives reports of multiple files causing suspicious activity on users' workstations. The file attempted to access highly confidential information in a centralized file server. Which two actions should be taken by a security analyst to evaluate the file in a sandbox? (Choose two.)

Correct AnswerverifiedShow Answer

Refer to the exhibit. What is the IOC threat and URL in this STIX JSON snippet?

Correct AnswerverifiedShow Answer

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified
A

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified
A,C

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified
A

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified