Question 1

Refer to the exhibit.

Which two actions should be taken based on the intelligence information? (Choose two.)

Options :

A : Block network access to all .shop domains

B : Add a SIEM rule to alert on connections to identified domains.

C : Use the DNS server to block hole all .shop requests.

D : Block network access to identified domains.

E : Route traffic from identified domains to block hole.

Answer: B,D

Question 2

Refer to the exhibit.

What is the IOC threat and URL in this STIX JSON snippet?

Options :

A :

malware;

‘http://x4z9arb.cn/4712/’

B : malware; x4z9arb backdoor

C : x4z9arb backdoor;http://x4z9arb.cn/4712/

D : malware; malware--162d917e-766f-4611-b5d6-652791454fca

E :

stix;

‘http://x4z9arb.cn/4712/’

Answer: A

Question 3

An incident responder reviews a log entry that shows a Microsoft Word process initiating an outbound network connection followed by PowerShell execution with obfuscated commands. Considering the machine's role in a sensitive data department, what is the most critical action for the responder to take next to analyze this output for potential indicators of compromise?

Options :

A : Compare the metadata of the Microsoft Word document with known templates to verify its authenticity.

B :

Examine the network destination of the outbound connection to assess the credibility and categorize the traffic.

C :

Conduct a behavioral analysis of the PowerShell execution pattern and deobfuscate the commands to assess malicious intent.

D :

Correlate the time of the outbound network connection with the user's activity log to establish a usage pattern.

Answer: C

Question 4

Refer to the exhibit.

What do these artifacts indicate?

Options :

A : An executable file is requesting an application download.

B : A malicious file is redirecting users to different domains.

C : The MD5 of a file is identified as a virus and is being blocked.

D : A forged DNS request is forwarding users to malicious websites.

Answer: B

Question 5

Options :

A : Destination IP 51.38.124.206 is identified as malicious

B : MD5 D634c0ba04a4e9140761cbd7b057t>8c5 is identified as malicious

C : Path http-req-51.38.124.206-80-14-1 is benign

D : The stream must be analyzed further via the pcap file

Answer: A

Confidently Practice Online with Free 300-215 Exam Cram

Buying Options: