The correct next step in analyzing the malicious nature of the email is toevaluate the artifactsinCisco Secure Malware Analytics(formerly Threat Grid). This tool provides a comprehensive sandbox environment where behavioral indicators like file execution, registry access, and domain connections are logged and scored. The exhibit shows: * Remote PowerShell execution * Executable download from a flagged domain * SHA256 hash linked to malware All these artifacts, as labeled in the Secure Malware Analytics output, arekey indicators of compromise, and analyzing them further can confirm whether the email was part of a malicious campaign. Thus, the best action is: A). Evaluate the artifacts in Cisco Secure Malware Analytics.
Question 122
Refer to the exhibit. What should an engineer determine from this Wireshark capture of suspicious network traffic?
Correct Answer: A
In the provided Wireshark capture, we see multiple TCP SYN packets being sent from different source IP addresses to the same destination IP address (192.168.1.159:80) within a short time window. These SYN packets do not show a corresponding SYN-ACK or ACK response, indicating that these TCP connection requests are not being completed. This pattern is indicative of a SYN flood attack, a type of Denial of Service (DoS) attack. In this attack, a malicious actor floods the target system with a high volume of TCP SYN requests, leaving the target ' s TCP connection queue (backlog) filled with half-open connections. This can exhaust system resources, causing legitimate connection requests to be denied or delayed. The countermeasure for this scenario, as highlighted in the CyberOps Technologies (CBRFIR) 300-215 study guide under Network-Based Attacks and TCP SYN Flood Attacks, involves: Increasing the backlog queue: This allows the server to hold more half-open connections. Recycling the oldest half-open connections: This ensures that legitimate connections have a chance to be established if the backlog fills up. Reference: CyberOps Technologies (CBRFIR) 300-215 study guide, Chapter 5: Identifying Attack Methods, SYN Flood Attack section, page 146-148.
Question 123
Refer to the exhibit. What do these artifacts indicate?
Correct Answer: B
Question 124
An engineer received a call to assist with an ongoing DDoS attack. The Apache server is being targeted, and availability is compromised. Which step should be taken to identify the origin of the threat?
Correct Answer: D
The best immediate step during a DDoS attack against an Apache web server is to inspect theaccess logs, which will show which IP addresses are making requests, their frequency, and potential patterns of abuse. As covered in the Cisco CyberOps material, "Apache logs can reveal the IPs responsible for flooding the service with requests". The commandsudo tail -100 /var/log/apache2/access.logallows quick review of recent activity.
Question 125
Refer to the exhibit. A security analyst notices that a web application running on NGINX is generating an unusual number of log messages. The application is operational and reachable. What is the cause of this activity?
Correct Answer: B
The provided log file contains multiple HTTP GET requests attempting to access various directories and files on the web server such as: * /balance * /security * /finance * /secret * /opt * /fuzzer/admin These requests appear to be sequential, systematically targeting commonly used file and directory paths. The response codes are mostly 404 (Not Found) and a few 301s, indicating that the requester is trying different permutations of paths to discover hidden or vulnerable endpoints. This behavior is consistent withdirectory fuzzing, a reconnaissance technique used by attackers (or automated tools) to map out web directory structures by sending a high volume of crafted requests to guess hidden or unlinked directories and files. This is distinct from DDoS (which would manifest as volume-based access issues), SQL injection (which targets specific parameters within requests), or botnet infection (which generally involves command-and- control communication or massive traffic floods). Reference:CyberOps Technologies (CBRFIR) 300-215 study guide, Chapter on Web Attacks and Threat Identification - Directory Fuzzing Patterns.
