Question 1

A security team needs to prevent a remote code execution vulnerability. The vulnerability can be exploited only by sending '${ string in the HTTP request. WAF rule is blocking '${', but system engineers detect that attackers are executing commands on the host anyway. Which action should the security team recommend?

Options :

A : Enable URL decoding on WAF.

B : Block incoming web traffic.

C : Add two WAF rules to block 'S' and '{' characters separately.

D : Deploy antimalware solution.

Answer: A

Question 2

Options :

A : Destination IP 51.38.124.206 is identified as malicious

B : MD5 D634c0ba04a4e9140761cbd7b057t>8c5 is identified as malicious

C : Path http-req-51.38.124.206-80-14-1 is benign

D : The stream must be analyzed further via the pcap file

Answer: A

Question 3

Refer to the exhibit.

Which two actions should be taken based on the intelligence information? (Choose two.)

Options :

A : Block network access to all .shop domains

B : Add a SIEM rule to alert on connections to identified domains.

C : Use the DNS server to block hole all .shop requests.

D : Block network access to identified domains.

E : Route traffic from identified domains to block hole.

Answer: B,D

Question 4

An attacker embedded a macro within a word processing file opened by a user in an organization’s legal department. The attacker used this technique to gain access to confidential financial data. Which two recommendations should a security expert make to mitigate this type of attack? (Choose two.)

Options :

A : controlled folder access

B : removable device restrictions

C : signed macro requirements

D : firewall rules creation

E : network access control

Answer: A,C

Question 5

Options :

A : Evaluate the artifacts in Cisco Secure Malware Analytics.

B : Evaluate the file activity in Cisco Umbrella.

C : Analyze the registry activity section in Cisco Umbrella.

D : Analyze the activity paths in Cisco Secure Malware Analytics.

Answer: A

Free 300-215 Mock Exam – Practice Online Confidently

Buying Options: