Question 1

What are YARA rules based upon?

Options :

A : binary patterns

B : HTML code

C : network artifacts

D : IP addresses

Answer: A

Question 2

Options :

A : Destination IP 51.38.124.206 is identified as malicious

B : MD5 D634c0ba04a4e9140761cbd7b057t>8c5 is identified as malicious

C : Path http-req-51.38.124.206-80-14-1 is benign

D : The stream must be analyzed further via the pcap file

Answer: A

Question 3

Refer to the exhibit.

Which two actions should be taken based on the intelligence information? (Choose two.)

Options :

A : Block network access to all .shop domains

B : Add a SIEM rule to alert on connections to identified domains.

C : Use the DNS server to block hole all .shop requests.

D : Block network access to identified domains.

E : Route traffic from identified domains to block hole.

Answer: B,D

Question 4

What is the steganography anti-forensics technique?

Options :

A : hiding a section of a malicious file in unused areas of a file

B : changing the file header of a malicious file to another file type

C : sending malicious files over a public network by encapsulation

D : concealing malicious files in ordinary or unsuspecting places

Answer: D

Question 5

In a secure government communication network, an automated alert indicates the presence of anomalous DLL files injected into the system memory during a routine update of communication protocols. These DLL files are exhibiting beaconing behavior to a satellite IP known for signal interception risks. Concurrently, there is an uptick in encrypted traffic volumes that suggests possible data exfiltration. Which set of actions should the security engineer prioritize?

Options :

A :

Invoke a classified incident response scenario, notify national defense cyber operatives, and begin containment and eradication procedures on affected systems.

B :

Conduct memory forensics to analyze the suspicious DLL files, disrupt the beaconing sequence, and assess the encrypted traffic for breach indicators.

C :

Activate a secure emergency communication channel, isolate the segments of the communication network, and initiate a threat hunting operation for further anomalies.

D :

Sever connections to the satellite IP, execute a rollback of the recent protocol updates, and engage counter-intelligence cybersecurity measures.

Answer: A

Confidently Practice Online with Free 300-215 Exam Cram

Buying Options: