Cisco 300-215 CBRFIR Exam Questions Instant Access

Question 1

Refer to the exhibit.

multiple machines behave abnormally. A sandbox analysis reveals malware. What must the administrator determine next?

Aif Patient 0 still demonstrates suspicious behavior

Bsource code of the malicious attachment

Cif the file in Patient 0 is encrypted

Dif Patient 0 tried to connect to another workstation

Answer : D

The key goal during lateral movement analysis is to determine whether the malware spread or attempted to spread beyond the initially compromised system. This is crucial for containment and scoping of the incident. Logs, sandbox behavior, or network activity may show if Patient 0 initiated outbound connections to other systems, potentially propagating malware across the environment.

Correct answer: D. if Patient 0 tried to connect to another workstation.

Question 2

Refer to the exhibit.

A security analyst is reviewing alerts from the SIEM system that was just implemented and notices a possible indication of an attack because the SSHD system just went live and there should be nobody using it. Which action should the analyst take to respond to the alert?

AInvestigate the alert by checking SSH logs and correlating with other relevant data in SIEM.

BReset the admin password in SSHD to prevent unauthorized access to the system at scale.

CIgnore the alert and continue monitoring for further activity because the system was just implemented.

DImmediately block the IP address 192.168.1.100 from accessing the SSHD environment.

Answer : A

The log entry shows a failed SSH login attempt for an invalid user ''admin'' from IP 192.168.1.100. As the system has just gone live and no legitimate use is expected, this could be an early reconnaissance or brute-force attempt. However, blocking IPs or resetting passwords without fully understanding the context could lead to incomplete remediation or false positives.

According to Cisco CyberOps best practices, the first step is to thoroughly investigate the alert by correlating it with other logs (e.g., authentication logs, IDS/IPS logs) to determine the intent and scope of activity.

---

Question 3

Refer to the exhibit.

What does the exhibit indicate?

AThe new file is created under the Software\Classes disk folder.

BA UAC bypass is created by modifying user-accessible registry settings.

CA scheduled task named 'DelegateExecute' is created.

DThe shell software is modified via PowerShell.

Answer : B

The exhibit shows a PowerShell script that modifies registry keys under:

HKCU:\Software\Classes\Folder\shell\open\command

This technique is commonly associated with a UAC (User Account Control) bypass. Specifically:

It creates a new custom shell command path for opening folders.

The key registry property 'DelegateExecute' is set, which is a known bypass method. If set without a value, it may cause Windows to run commands with elevated privileges without showing the UAC prompt.

The use of HKCU (HKEY_CURRENT_USER) rather than HKLM (HKEY_LOCAL_MACHINE) allows the attacker to bypass permissions since HKCU is writable by the current user. This registry hijack can be leveraged by a malicious actor to execute arbitrary commands with elevated rights.

This is identified in the Cisco CyberOps study material under ''UAC bypass techniques,'' which describes:

''Attackers often create or modify registry keys like DelegateExecute to hijack the default behavior of applications and elevate privileges''.

Thus, option B is correct: the exhibit demonstrates a UAC bypass using user-accessible registry modification.

Question 4

Refer to the exhibit.

Which encoding technique is represented by this HEX string?

AUnicode

BBinary

CBase64

DCharcode

Answer : D

The hexadecimal representation in the exhibit does not match the Base64 encoding format, which uses ASCII characters (A-Z, a-z, 0-9, +, /) and often includes padding with =. This string is clearly hex and is more aligned with Charcode, where hexadecimal values represent individual characters based on ASCII values.

The Cisco CyberOps Associate guide refers to such encodings during forensic analysis and emphasizes identifying patterns in memory dumps, payloads, or logs. 'Security professionals often decode hexadecimal strings to reveal ASCII representations, particularly when inspecting encoded payloads or character obfuscation techniques used in malware'.

Question 5

A company had a recent data leak incident. A security engineer investigating the incident discovered that a malicious link was accessed by multiple employees. Further investigation revealed targeted phishing attack attempts on macOS systems, which led to backdoor installations and data compromise. Which two security solutions should a security engineer recommend to mitigate similar attacks in the future? (Choose two.)

Aendpoint detection and response

Bsecure email gateway

Cdata loss prevention

Dintrusion prevention system

Eweb application firewall

Answer : A, B

Comprehensive and Detailed

Endpoint Detection and Response (EDR) tools provide behavioral analytics and continuous monitoring to detect malware such as backdoors, which is especially critical on endpoints like macOS devices. These tools are essential to detect post-compromise activities and contain threats before they spread.

Secure Email Gateway (e.g., Cisco ESA) plays a key role in blocking phishing emails---the initial vector in this attack. It uses filters and reputation analysis to prevent malicious links or attachments from reaching end users.

Incorrect Options:

C . DLP focuses on preventing data exfiltration, not phishing prevention or backdoor detection.

D . IPS is effective for known signature-based threats but less effective against phishing links and endpoint-level backdoors.

E . WAF protects web servers, not end-user devices from phishing or backdoor infections.

Therefore, the correct answers are: A and B.

Question 6

What is the purpose of YARA rules in malware analysis and now do the rules atd in identifying, classifying, and documenting malware?

AThey automatically remove malware from an infected system while documenting the behavior of the APT

BThey encrypt identified malware on a system to prevent execution of files with the same classification

CThey create a backup of identified malware and classify it according to its origin and source

DThey use specific static patterns and attributes to identify and classify matware, characterizing its nature

Answer : D

Question 7

Refer to the exhibit.

What is occurring?

AThe request was redirected.

BWAF detected code injection.

CAn attacker attempted SQL injection.

DThe requested page was not found.

Answer : D

Comprehensive and Detailed

The log entry contains the following key elements:

The timestamp: (04/Jan/2022:20:18:06 +0000)

HTTP method and URI: 'GET /%60%60%60%60%60%60/ HTTP/2.0'

HTTP status code: 404

User-Agent: Mozilla/5.0 ... Firefox/95.0

The status code 404 indicates that the requested resource was not found on the server. This is a standard HTTP response that signifies the server could not locate the requested URI (in this case, likely due to a malformed or invalid path /\`````/, where %60 is the URL-encoded form of the backtick character '').

There is no clear evidence of SQL injection, WAF detection, or redirection in this log. The use of encoded backticks may suggest probing behavior, but the log does not show a definitive attack signature.

Therefore, the correct interpretation is:

Cisco Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity 300-215 CBRFIR Exam Questions