Question 1

Refer to the exhibit.

What do these artifacts indicate?

Options :

A : An executable file is requesting an application download.

B : A malicious file is redirecting users to different domains.

C : The MD5 of a file is identified as a virus and is being blocked.

D : A forged DNS request is forwarding users to malicious websites.

Answer: B

Question 2

A security team needs to prevent a remote code execution vulnerability. The vulnerability can be exploited only by sending '${ string in the HTTP request. WAF rule is blocking '${', but system engineers detect that attackers are executing commands on the host anyway. Which action should the security team recommend?

Options :

A : Enable URL decoding on WAF.

B : Block incoming web traffic.

C : Add two WAF rules to block 'S' and '{' characters separately.

D : Deploy antimalware solution.

Answer: A

Question 3

What are YARA rules based upon?

Options :

A : binary patterns

B : HTML code

C : network artifacts

D : IP addresses

Answer: A

Question 4

An incident responder reviews a log entry that shows a Microsoft Word process initiating an outbound network connection followed by PowerShell execution with obfuscated commands. Considering the machine's role in a sensitive data department, what is the most critical action for the responder to take next to analyze this output for potential indicators of compromise?

Options :

A : Compare the metadata of the Microsoft Word document with known templates to verify its authenticity.

B :

Examine the network destination of the outbound connection to assess the credibility and categorize the traffic.

C :

Conduct a behavioral analysis of the PowerShell execution pattern and deobfuscate the commands to assess malicious intent.

D :

Correlate the time of the outbound network connection with the user's activity log to establish a usage pattern.

Answer: C

Question 5

An attacker embedded a macro within a word processing file opened by a user in an organization’s legal department. The attacker used this technique to gain access to confidential financial data. Which two recommendations should a security expert make to mitigate this type of attack? (Choose two.)

Options :

A : controlled folder access

B : removable device restrictions

C : signed macro requirements

D : firewall rules creation

E : network access control

Answer: A,C

Free 300-215 Mock Exam – Practice Online Confidently

Buying Options: