Latest 300-215 exam dumps with real Cisco questions and answers [Q37-Q52]

Q37. An incident response analyst is preparing to scan memory using a YARA rule. How is this task completed?

Q38. The Linux system administrator of a company suspects that physical unauthorized access was granted to a local Linux terminal. The administrator wants to examine the suspected machine for potential unauthorized use and to get information about even/ account in this terminal including when the password last changed The administrator logs in as a root user Which file should be examined to get the information?

Q39. Refer to the exhibit.

A cybersecurity analyst is presented with the snippet of code used by the threat actor and left behind during the latest incident and is asked to determine its type based on its structure and functionality. What is the type of code being examined?

Q40. Refer to the exhibit.

What is occurring?

Q41. Which tool is used for reverse engineering malware?

Q42. Refer to the exhibit.

What is occurring?

Q43. A security team received an alert of suspicious activity on a user’s Internet browser. The user’s anti-virus software indicated that the file attempted to create a fake recycle bin folder and connect to an external IP address. Which two actions should be taken by the security analyst with the executable file for further analysis? (Choose two.)

Q44.

Q45. An organization recovered from a recent ransomware outbreak that resulted in significant business damage. Leadership requested a report that identifies the problems that triggered the incident and the security team’s approach to address these problems to prevent a reoccurrence. Which components of the incident should an engineer analyze first for this report?

Q46. Refer to the exhibit.

What is occurring?

Q47.

Refer to the exhibit. A network engineer is analyzing a Wireshark file to determine the HTTP request that caused the initial Ursnif banking Trojan binary to download. Which filter did the engineer apply to sort the Wireshark traffic logs?

Q48. What is the steganography anti-forensics technique?

Q49. Which scripts will search a log file for the IP address of 192.168.100.100 and create an output file named parsed_host.log while printing results to the console?

Q50. An engineer must advise on how YARA rules can enhance detection capabilities. What can YARA rules be used to identify?

Q51. Refer to the exhibit.

An HR department submitted a ticket to the IT helpdesk indicating slow performance on an internal share server. The helpdesk engineer checked the server with a real-time monitoring tool and did not notice anything suspicious. After checking the event logs, the engineer noticed an event that occurred 48 hours prior. Which two indicators of compromise should be determined from this information? (Choose two.)

Q52. What describes the first step in performing a forensic analysis of infrastructure network devices?