Conducting Forensic Analysis and Incident Response Using Cisco Technologies (CBRFIR) practice questions

1. Question 1 of 25

   Select 2

   A security team is discussing lessons learned and suggesting process changes after a security breach incident. During the incident, members of the security team failed to report the abnormal system activity due to a high project workload. Additionally, when the incident was identified, the response took six hours due to management being unavailable to provide the approvals needed. Which two steps will prevent these issues from occurring in the future? (Choose two.)

   • AIntroduce a priority rating for incident response workloads.
   • BProvide phishing awareness training for the fill security team.
   • CConduct a risk audit of the incident response workflow.
   • DCreate an executive team delegation plan.
   • EAutomate security alert timeframes with escalation triggers.

   Show answer

   Correct answer: A, E

   How others answered

   • AD100%

   Most people chose AD, not AE. Verify this one against the vendor documentation.

2. Question 2 of 25

   Select 2

   An engineer is investigating a ticket from the accounting department in which a user discovered an unexpected application on their workstation. Several alerts are seen from the intrusion detection system of unknown outgoing internet traffic from this workstation. The engineer also notices a degraded processing capability, which complicates the analysis process. Which two actions should the engineer take? (Choose two.)

   • ARestore to a system recovery point.
   • BReplace the faulty CPU.
   • CDisconnect from the network.
   • DFormat the workstation drives.
   • ETake an image of the workstation.

   Show answer

   Correct answer: C, E

   How others answered

   • CE100%

3. Question 3 of 25

   

   Refer to the exhibit. What should an engineer determine from this Wireshark capture of suspicious network traffic?

   • AThere are signs of SYN flood attack, and the engineer should increase the backlog and recycle the oldest half-open TCP connections.
   • BThere are signs of a malformed packet attack, and the engineer should limit the packet size and set a threshold of bytes as a countermeasure.
   • CThere are signs of a DNS attack, and the engineer should hide the BIND version and restrict zone transfers as a countermeasure.
   • DThere are signs of ARP spoofing, and the engineer should use Static ARP entries and IP address-to-MAC address mappings as a countermeasure.

   Show answer

   Correct answer: A

   How others answered

   • A100%

4. Question 4 of 25

   

   Refer to the exhibit. A network engineer is analyzing a Wireshark file to determine the HTTP request that caused the initial Ursnif banking Trojan binary to download. Which filter did the engineer apply to sort the Wireshark traffic logs?

   • Ahttp.request.un matches
   • Btls.handshake.type ==1
   • Ctcp.port eq 25
   • Dtcp.window_size ==0

   Show answer

   Correct answer: B

5. Question 5 of 25

   What is a concern for gathering forensics evidence in public cloud environments?

   • AHigh Cost: Cloud service providers typically charge high fees for allowing cloud forensics.
   • BConfiguration: Implementing security zones and proper network segmentation.
   • CTimeliness: Gathering forensics evidence from cloud service providers typically requires substantial time.
   • DMultitenancy: Evidence gathering must avoid exposure of data from other tenants.

   Show answer

   Correct answer: D

6. Question 6 of 25

   What is the transmogrify anti-forensics technique?

   • Ahiding a section of a malicious file in unused areas of a file
   • Bsending malicious files over a public network by encapsulation
   • Cconcealing malicious files in ordinary or unsuspecting places
   • Dchanging the file header of a malicious file to another file type

   Show answer

   Correct answer: D

   How others answered

   • D100%

7. Question 7 of 25

   What is the steganography anti-forensics technique?

   • Ahiding a section of a malicious file in unused areas of a file
   • Bchanging the file header of a malicious file to another file type
   • Csending malicious files over a public network by encapsulation
   • Dconcealing malicious files in ordinary or unsuspecting places

   Show answer

   Correct answer: A

   How others answered

   • D100%

   Most people chose D, not A. Verify this one against the vendor documentation.

8. Question 8 of 25

   Select 2

   A security team receives reports of multiple files causing suspicious activity on users' workstations. The file attempted to access highly confidential information in a centralized file server. Which two actions should be taken by a security analyst to evaluate the file in a sandbox? (Choose two.)

   • AInspect registry entries
   • BInspect processes.
   • CInspect file hash.
   • DInspect file type.
   • EInspect PE header.

   Show answer

   Correct answer: B, C

9. Question 9 of 25

   

   Refer to the exhibit. An engineer is analyzing a .LNK (shortcut) file recently received as an email attachment and blocked by email security as suspicious. What is the next step an engineer should take?

   • ADelete the suspicious email with the attachment as the file is a shortcut extension and does not represent any threat.
   • BUpload the file to a virus checking engine to compare with well-known viruses as the file is a virus disguised as a legitimate extension.
   • CQuarantine the file within the endpoint antivirus solution as the file is a ransomware which will encrypt the documents of a victim.
   • DOpen the file in a sandbox environment for further behavioral analysis as the file contains a malicious script that runs on execution.

   Show answer

   Correct answer: D

   How others answered

   • D100%

10. Question 10 of 25

    An investigator is analyzing an attack in which malicious files were loaded on the network and were undetected. Several of the images received during the attack include repetitive patterns. Which anti-forensic technique was used?

    • Aspoofing
    • Bobfuscation
    • Ctunneling
    • Dsteganography

    Show answer

    Correct answer: D

    How others answered

    • D100%

11. Question 11 of 25

    Select 2

    A security team detected an above-average amount of inbound tcp/135 connection attempts from unidentified senders. The security team is responding based on their incident response playbook. Which two elements are part of the eradication phase for this incident? (Choose two.)

    • Aanti-malware software
    • Bdata and workload isolation
    • Ccentralized user management
    • Dintrusion prevention system
    • Eenterprise block listing solution

    Show answer

    Correct answer: C, D

    How others answered

    • CD100%

12. Question 12 of 25

    

    Refer to the exhibit. What is the IOC threat and URL in this STIX JSON snippet?

    • Amalware; "˜http://x4z9arb.cn/4712/'
    • Bmalware; x4z9arb backdoor
    • Cx4z9arb backdoor; http://x4z9arb.cn/4712/
    • Dmalware; malware--162d917e-766f-4611-b5d6-652791454fca
    • Estix; "˜http://x4z9arb.cn/4712/'

    Show answer

    Correct answer: D

13. Question 13 of 25

    

    Refer to the exhibit. Which type of code is being used?

    • AShell
    • BVBScript
    • CBASH
    • DPython

    Show answer

    Correct answer: D

    How others answered

    • D100%

14. Question 14 of 25

    

    Refer to the exhibit. An engineer is analyzing a TCP stream in a Wireshark after a suspicious email with a URL. What should be determined about the SMB traffic from this stream?

    • AIt is redirecting to a malicious phishing website,
    • BIt is exploiting redirect vulnerability
    • CIt is requesting authentication on the user site.
    • DIt is sharing access to files and printers.

    Show answer

    Correct answer: B

    How others answered

    • D100%

    Most people chose D, not B. Verify this one against the vendor documentation.

15. Question 15 of 25

    An employee receives an email from a "trusted" person containing a hyperlink that is malvertising. The employee clicks the link and the malware downloads. An information analyst observes an alert at the SIEM and engages the cybersecurity team to conduct an analysis of this incident in accordance with the incident response plan. Which event detail should be included in this root cause analysis?

    • Aphishing email sent to the victim
    • Balarm raised by the SIEM
    • Cinformation from the email header
    • Dalert identified by the cybersecurity team

    Show answer

    Correct answer: B

16. Question 16 of 25

    Select 2

    

    Refer to the exhibit. Which two determinations should be made about the attack from the Apache access logs? (Choose two.)

    • AThe attacker used r57 exploit to elevate their privilege.
    • BThe attacker uploaded the word press file manager trojan.
    • CThe attacker performed a brute force attack against word press and used sql injection against the backend database.
    • DThe attacker used the word press file manager plugin to upoad r57.php.
    • EThe attacker logged on normally to word press admin page.

    Show answer

    Correct answer: C, D

    How others answered

    • DE100%

    Most people chose DE, not CD. Verify this one against the vendor documentation.

17. Question 17 of 25

    Which magic byte indicates that an analyzed file is a pdf file?

    • AcGRmZmlsZQ
    • B706466666
    • C255044462d
    • D0a0ah4cg

    Show answer

    Correct answer: C

    How others answered

    • C100%

18. Question 18 of 25

    An engineer received a call to assist with an ongoing DDoS attack. The Apache server is being targeted, and availability is compromised. Which step should be taken to identify the origin of the threat?

    • AAn engineer should check the list of usernames currently logged in by running the command $ who | cut ""d' "˜ -f1| sort | uniq
    • BAn engineer should check the server's processes by running commands ps -aux and sudo ps -a.
    • CAn engineer should check the services on the machine by running the command service -status-all.
    • DAn engineer should check the last hundred entries of a web server with the command sudo tail -100 /var/log/apache2/access.log.

    Show answer

    Correct answer: D

    How others answered

    • D100%

19. Question 19 of 25

    

    Refer to the exhibit. According to the SNORT alert, what is the attacker performing?

    • Abrute-force attack against the web application user accounts
    • BXSS attack against the target webserver
    • Cbrute-force attack against directories and files on the target webserver
    • DSQL injection attack against the target webserver

    Show answer

    Correct answer: C

    How others answered

    • C100%

20. Question 20 of 25

    Select 2

    

    Refer to the exhibit. Which two actions should be taken as a result of this information? (Choose two.)

    • AUpdate the AV to block any file with hash "cf2b3ad32a8a4cfb05e9dfc45875bd70".
    • BBlock all emails sent from an @state.gov address.
    • CBlock all emails with pdf attachments.
    • DBlock emails sent from [email protected] with an attached pdf file with md5 hash "cf2b3ad32a8a4cfb05e9dfc45875bd70".
    • EBlock all emails with subject containing "cf2b3ad32a8a4cfb05e9dfc45875bd70".

    Show answer

    Correct answer: A, B

    How others answered

    • AD100%

    Most people chose AD, not AB. Verify this one against the vendor documentation.

21. Question 21 of 25

    

    Refer to the exhibit. What should be determined from this Apache log?

    • AA module named mod_ssl is needed to make SSL connections.
    • BThe private key does not match with the SSL certificate.
    • CThe certificate file has been maliciously modified
    • DThe SSL traffic setup is improper

    Show answer

    Correct answer: D

    How others answered

    • B100%

    Most people chose B, not D. Verify this one against the vendor documentation.

22. Question 22 of 25

    What are YARA rules based upon?

    • Abinary patterns
    • BHTML code
    • Cnetwork artifacts
    • DIP addresses

    Show answer

    Correct answer: A

    How others answered

    • A100%

23. Question 23 of 25

    An engineer is analyzing a ticket for an unexpected server shutdown and discovers that the web-server ran out of useable memory and crashed. Which data is needed for further investigation?

    • A/var/log/access.log
    • B/var/log/messages.log
    • C/var/log/httpd/messages.log
    • D/var/log/httpd/access.log

    Show answer

    Correct answer: B

    How others answered

    • B100%

24. Question 24 of 25

    

    Refer to the exhibit. An employee notices unexpected changes and setting modifications on their workstation and creates an incident ticket. A support specialist checks processes and services but does not identify anything suspicious. The ticket was escalated to an analyst who reviewed this event log and also discovered that the workstation had multiple large data dumps on network shares. What should be determined from this information?

    • Adata obfuscation
    • Breconnaissance attack
    • Cbrute-force attack
    • Dlog tampering

    Show answer

    Correct answer: D

    How others answered

    • D100%

25. Question 25 of 25

    

    Refer to the exhibit. A company that uses only the Unix platform implemented an intrusion detection system. After the initial configuration, the number of alerts is overwhelming, and an engineer needs to analyze and classify the alerts. The highest number of alerts were generated from the signature shown in the exhibit. Which classification should the engineer assign to this event?

    • ATrue Negative alert
    • BFalse Negative alert
    • CFalse Positive alert
    • DTrue Positive alert

    Show answer

    Correct answer: C

    How others answered

    • C100%

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-215 practice, question 1 of 25