Free Cisco 300-215 Exam Dumps Questions & Answers

A company's security engineer notices through the SIEM that an employee's workstation sent several DNS requests involving the external IP address of the suspicious domain a4sn77d8z3dsci9416cov.com. After investigating multiple log sources, the security team determines that the employee downloaded an infected PDF file through a URL in an email. Which two elements must be included in the root cause analysis report?
(Choose two.)

• A.Malicious insider
• B.Suspicious domain
• C.Phishing attempt
• D.DNS requests to the external IP address
• E.Malware with a command-and-control callback

• A.The stream must be analyzed further via the pcap file
• B.Path http-req-51.38.124.206-80-14-1 is benign
• C.MD5 D634c0ba04a4e9140761cbd7b057t > 8c5 is identified as malicious
• D.Destination IP 51.38.124.206 is identified as malicious

An enterprise security analyst is investigating a potential breach. Internal logs show repeated login failures from an internal IP address, followed by a successful login during the early morning when no staff should be active. External threat intelligence associates the IP range with a known malicious actor. Which action correctly interprets the threat-intelligence data and determines IOCs and IOAs?

• A.Focus on internal log data while considering external threat feeds only for broader context.
• B.Compare the successful login's IP address with known malicious IP ranges and analyze the account's subsequent actions.
• C.Monitor the internal IP address for additional login attempts before investigating further.
• D.Treat the login failures as a potential system error because a successful login eventually occurred.

Refer to the exhibit. A security analyst notices that a web application running on NGINX is generating an unusual number of log messages. The application is operational and reachable. What is the cause of this activity?

• A.SQL injection
• B.botnet infection
• C.DDoS attack
• D.directory fuzzing

An analyst finds .xyz files of unknown origin that are large and undetected by antivirus. What action should be taken next?

• A.Move the files to a less secure network segment for analysis.
• B.Delete the files immediately to prevent potential risks.
• C.Isolate the files and perform a deeper heuristic analysis to detect potential unknown malware or data exfiltration payloads.
• D.Rename the file extensions to .txt to enable easier opening and review by team members.