Question 1

An engineer received a call to assist with an ongoing DDoS attack. The Apache server is being targeted, and availability is compromised. Which step should be taken to identify the origin of the threat?

Accepted Answer

Checking the last hundred entries of the Apache access log can help identify unusual or suspicious IP addresses that may be part of the DDoS attack, providing insight into the origin of the threat.

Question 2

What is the function of a disassembler?

Accepted Answer

A disassembler is a tool used in static analysis to convert machine code into assembly language, which helps in understanding the program's functionality without executing it.

Question 3

An "unknown error code" is appearing on an ESXi host during authentication. An engineer checks the authentication logs but is unable to identify the issue. Analysis of the vCenter agent logs shows no connectivity errors. What is the next log file the engineer should check to continue troubleshooting this error?

Accepted Answer

The syslog.log file contains system messages and errors, which can provide more information on authentication issues.

Question 4

Which information is provided bout the object file by the "-h" option in the objdump line command objdump -b oasys -m vax -h fu.o ?

Accepted Answer

The "-h" option in the objdump command is used to display the headers of the object file.

Question 5

An attacker embedded a macro within a word processing file opened by a user in an organization's legal department. The attacker used this technique to gain access to confidential financial data. Which two recommendations should a security expert make to mitigate this type of attack? (Choose two.)

Accepted Answer

The answer of An attacker embedded a macro within a...

Question 6

Refer to the exhibit. Which two actions should be taken based on the intelligence information? (Choose two.)

Accepted Answer

The answer of  Refer to the exhibit. Which two...

Question 7

A security team received an alert of suspicious activity on a user's Internet browser. The user's anti-virus software indicated that the file attempted to create a fake recycle bin folder and connect to an external IP address. Which two actions should be taken by the security analyst with the executable file for further analysis? (Choose two.)

Accepted Answer

The security analyst should analyze the TCP/IP Streams and evaluate the behavioral indicators in Cisco Secure Malware Analytics (Threat Grid) to understand the network behavior and potential malicious activities of the executable file.

Question 8

Which scripts will search a log file for the IP address of 192.168.100.100 and create an output file named parsed_host.log while printing results to the console?

Accepted Answer

The answer of Which scripts will search a log file...

Question 9

A security team is discussing lessons learned and suggesting process changes after a security breach incident. During the incident, members of the security team failed to report the abnormal system activity due to a high project workload. Additionally, when the incident was identified, the response took six hours due to management being unavailable to provide the approvals needed. Which two steps will prevent these issues from occurring in the future? (Choose two.)

Accepted Answer

The answer of A security team is discussing lessons learned...

Question 10

Refer to the exhibit. An engineer is analyzing a TCP stream in a Wireshark after a suspicious email with a URL. What should be determined about the SMB traffic from this stream?

Accepted Answer

The answer of  Refer to the exhibit. An engineer...

Question 11

Refer to the exhibit. A security analyst notices unusual connections while monitoring traffic. What is the attack vector, and which action should be taken to prevent this type of event?

Accepted Answer

The answer of  Refer to the exhibit. A security...

Question 12

Refer to the exhibit. Which encoding technique is represented by this HEX string?

Accepted Answer

The answer of  Refer to the exhibit. Which encoding...

Question 13

Which tool conducts memory analysis?

Accepted Answer

Volatility is a powerful memory analysis tool that allows users to examine the contents of physical memory dumps. It can be used to identify malware, investigate security incidents, and perform forensic analysis.

Question 14

Which technique is used to evade detection from security products by executing arbitrary code in the address space of a separate live operation?

Accepted Answer

Process injection is a technique used to execute arbitrary code within the address space of another process, helping to evade detection by security products.

Question 15

A security team receives reports of multiple files causing suspicious activity on users' workstations. The file attempted to access highly confidential information in a centralized file server. Which two actions should be taken by a security analyst to evaluate the file in a sandbox? (Choose two.)

Accepted Answer

The answer of A security team receives reports of multiple...

Question 16

Refer to the exhibit. What is the IOC threat and URL in this STIX JSON snippet?

Accepted Answer

The answer of  Refer to the exhibit. What is...

Question 17

Which magic byte indicates that an analyzed file is a pdf file?

Accepted Answer

The magic byte "255044462d" corresponds to the ASCII characters "%PDF-", which is the standard header for PDF files.

Question 18

Refer to the exhibit. A network engineer is analyzing a Wireshark file to determine the HTTP request that caused the initial Ursnif banking Trojan binary to download. Which filter did the engineer apply to sort the Wireshark traffic logs?

Accepted Answer

The answer of  Refer to the exhibit. A network...

Question 19

Refer to the exhibit. Which two determinations should be made about the attack from the Apache access logs? (Choose two.)

Accepted Answer

The answer of  Refer to the exhibit. Which two...

Question 20

A website administrator has an output of an FTP session that runs nightly to download and unzip files to a local staging server. The download includes thousands of files, and the manual process used to find how many files failed to download is time-consuming. The administrator is working on a PowerShell script that will parse a log file and summarize how many files were successfully downloaded versus ones that failed. Which script will read the contents of the file one line at a time and return a collection of objects?

Accepted Answer

The `Get-Content` cmdlet reads the contents of a file line by line, and `Select-String` can be used to search for specific patterns like "ERROR" and "SUCCESS" in those lines, returning a collection of matching objects.

Exam 7: Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

An engineer received a call to assist with an ongoing DDoS attack. The Apache server is being targeted, and availability is compromised. Which step should be taken to identify the origin of the threat?

What is the function of a disassembler?

Which information is provided bout the object file by the "-h" option in the objdump line command objdump -b oasys -m vax -h fu.o ?

An attacker embedded a macro within a word processing file opened by a user in an organization's legal department. The attacker used this technique to gain access to confidential financial data. Which two recommendations should a security expert make to mitigate this type of attack? (Choose two.)

Refer to the exhibit. Which two actions should be taken based on the intelligence information? (Choose two.)

Which scripts will search a log file for the IP address of 192.168.100.100 and create an output file named parsed_host.log while printing results to the console?

Refer to the exhibit. An engineer is analyzing a TCP stream in a Wireshark after a suspicious email with a URL. What should be determined about the SMB traffic from this stream?

Refer to the exhibit. A security analyst notices unusual connections while monitoring traffic. What is the attack vector, and which action should be taken to prevent this type of event?

Refer to the exhibit. Which encoding technique is represented by this HEX string?

Which tool conducts memory analysis?

Which technique is used to evade detection from security products by executing arbitrary code in the address space of a separate live operation?

A security team receives reports of multiple files causing suspicious activity on users' workstations. The file attempted to access highly confidential information in a centralized file server. Which two actions should be taken by a security analyst to evaluate the file in a sandbox? (Choose two.)

Refer to the exhibit. What is the IOC threat and URL in this STIX JSON snippet?

Which magic byte indicates that an analyzed file is a pdf file?

Refer to the exhibit. A network engineer is analyzing a Wireshark file to determine the HTTP request that caused the initial Ursnif banking Trojan binary to download. Which filter did the engineer apply to sort the Wireshark traffic logs?

Refer to the exhibit. Which two determinations should be made about the attack from the Apache access logs? (Choose two.)