Free 300-215 Practice Test & Exam Questions (Page 4 )

QUESTION: 1

A security team is discussing lessons learned and suggesting process changes after a security breach incident. During the incident, members of the security team failed to report the abnormal system activity due to a high project workload. Additionally, when the incident was identified, the response took six hours due to management being unavailable to provide the approvals needed. Which two steps will prevent these issues from occurring in the future? (Choose two.)

Introduce a priority rating for incident response workloads.
Provide phishing awareness training for the fill security team.
Conduct a risk audit of the incident response workflow.
Create an executive team delegation plan.
Automate security alert timeframes with escalation triggers.

Answer(s): A,E

Show Answer Next Question

QUESTION: 32

Which information is provided bout the object file by the “-h” option in the objdump line command objdump –b oasys –m vax –h fu.o?

bfdname
debugging
help
headers

Answer(s): D

Reference:

https://sourceware.org/binutils/docs/binutils/objdump.html

Show Answer Next Question

QUESTION: 33

A threat actor attempts to avoid detection by turning data into a code that shifts numbers to the right four times. Which anti-forensics technique is being used?

encryption
tunneling
obfuscation
poisoning

Answer(s): C

Reference:

https://www.vadesecure.com/en/malware-analysis-understanding-code-obfuscation-techniques/#:~:text=Obfuscation%20of%20character%20strings%20is,data%20when%20the%20code%20executes.

Show Answer Next Question

QUESTION: 34

Which technique is used to evade detection from security products by executing arbitrary code in the address space of a separate live operation?

process injection
privilege escalation
GPO modification
token manipulation

Answer(s): A

Reference:

https://attack.mitre.org/techniques/T1055/

Show Answer Next Question

QUESTION: 35

Refer to the exhibit.

An HR department submitted a ticket to the IT helpdesk indicating slow performance on an internal share server. The helpdesk engineer checked the server with a real-time monitoring tool and did not notice anything suspicious. After checking the event logs, the engineer noticed an event that occurred 48 hour prior. Which two indicators of compromise should be determined from this information? (Choose two.)

unauthorized system modification
privilege escalation
denial of service attack
compromised root access
malware outbreak

Answer(s): A,D

Show Answer Next Question

Cisco 300-215 Exam
Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR) (Page 4 )

QUESTION: 1

QUESTION: 32

Reference:

QUESTION: 33

Reference:

QUESTION: 34

Reference:

QUESTION: 35

Join the 300-215 Discussion

Cisco 300-215 Exam Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR) (Page 4 )

QUESTION: 1

QUESTION: 32

Reference:

QUESTION: 33

Reference:

QUESTION: 34

Reference:

QUESTION: 35

Join the 300-215 Discussion

Cisco 300-215 Exam
Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR) (Page 4 )