Cisco 300-215 Actual Free Exam Questions & Community Discussion

Refer to the exhibit.

What is the indicator of compromise?

Over the last year, an organization's HR department has accessed data from its legal department on the last day of each month to create a monthly activity report. An engineer is analyzing suspicious activity alerted by a threat intelligence platform that an authorized user in the HR department has accessed legal data daily for the last week. The engineer pulled the network data from the legal department's shared folders and discovered above average-size data dumps. Which threat actor is implied from these artifacts?

An employee receives an email from a "trusted" person containing a hyperlink that is malvertising. The employee clicks the link and the malware downloads. An information analyst observes an alert at the SIEM and engages the cybersecurity team to conduct an analysis of this incident in accordance with the incident response plan. Which event detail should be included in this root cause analysis?

What is the steganography anti-forensics technique?

Which technique exemplifies an antiforensic technique?

What is the purpose of YARA rules in malware analysis and now do the rules atd in identifying, classifying, and documenting malware?

An analyst finds .xyz files of unknown origin that are large and undetected by antivirus. What action should be taken next?

Refer to the exhibit.

Which type of code created the snippet?

An engineer received a report of a suspicious email from an employee. The employee had already opened the attachment, which was an empty Word document. The engineer cannot identify any clear signs of compromise but while reviewing running processes, observes that PowerShell.exe was spawned by cmd.exe with a grandparent winword.exe process. What is the recommended action the engineer should take?

Refer to the exhibit. A security analyst notices that a web application running on NGINX is generating an unusual number of log messages. The application is operational and reachable. What is the cause of this activity?