How to pass Cisco 300-215 exam with the help of dumps?

Question # 1

An engineer is analyzing a ticket for an unexpected server shutdown and discovers that the web-server ran out of useable memory and crashed. Which data is needed for further investigation? 

A. /var/log/access.log
 B. /var/log/messages.log 
C. /var/log/httpd/messages.log 
D. /var/log/httpd/access.log 

Show Answer

Question # 2

Which technique is used to evade detection from security products by executing arbitrary code in the address space of a separate live operation? 

A. process injection 
B. privilege escalation 
C. GPO modification 
D. token manipulation 

Show Answer

Question # 3

Refer to the exhibit. An engineer is analyzing a TCP stream in a Wireshark after a suspicious email with a URL. What should be determined about the SMB traffic from this stream?

A. It is redirecting to a malicious phishing website, 
B. It is exploiting redirect vulnerability 
C. It is requesting authentication on the user site. 
D. It is sharing access to files and printers. 

Show Answer

Question # 4

Refer to the exhibit. What should an engineer determine from this Wireshark capture of suspicious network traffic?

A. There are signs of SYN flood attack, and the engineer should increase the backlog and recycle the oldest half-open TCP connections. 
B. There are signs of a malformed packet attack, and the engineer should limit the packet size and set a threshold of bytes as a countermeasure. 
C. There are signs of a DNS attack, and the engineer should hide the BIND version and restrict zone transfers as a countermeasure. 
D. There are signs of ARP spoofing, and the engineer should use Static ARP entries and IP address-to-MAC address mappings as a countermeasure.

Show Answer

Question # 5

A network host is infected with malware by an attacker who uses the host to make calls for files and shuttle traffic to bots. This attack went undetected and resulted in a significant loss. The organization wants to ensure this does not happen in the future and needs a security solution that will generate alerts when command and control communication from an infected device is detected. Which network security solution should be recommended? 

A. Cisco Secure Firewall ASA 
B. Cisco Secure Firewall Threat Defense (Firepower) 
C. Cisco Secure Email Gateway (ESA) 
D. Cisco Secure Web Appliance (WSA) 

Show Answer

Question # 6

An employee receives an email from a “trusted” person containing a hyperlink that is malvertising. The employee clicks the link and the malware downloads. An information analyst observes an alert at the SIEM and engages the cybersecurity team to conduct an analysis of this incident in accordance with the incident response plan. Which event detail should be included in this root cause analysis? 

A. phishing email sent to the victim 
B. alarm raised by the SIEM 
C. information from the email header 
D. alert identified by the cybersecurity team 

Show Answer

Question # 7

What are YARA rules based upon? 

A. binary patterns 
B. HTML code 
C. network artifacts 
D. IP addresses

Show Answer

Question # 8

Refer to the exhibit. Which two determinations should be made about the attack from the Apache access logs? (Choose two.)

A. The attacker used r57 exploit to elevate their privilege. 
B. The attacker uploaded the word press file manager trojan. 
C. The attacker performed a brute force attack against word press and used sql injection against the backend database. 
D. The attacker used the word press file manager plugin to upoad r57.php. 
E. The attacker logged on normally to word press admin page. 

Show Answer

Question # 9

An engineer received a report of a suspicious email from an employee. The employee had already opened the attachment, which was an empty Word document. The engineer cannot identify any clear signs of compromise but while reviewing running processes, observes that PowerShell.exe was spawned by cmd.exe with a grandparent winword.exe process. What is the recommended action the engineer should take? 

A. Upload the file signature to threat intelligence tools to determine if the file is malicious.
 B. Monitor processes as this a standard behavior of Word macro embedded documents. 
C. Contain the threat for further analysis as this is an indication of suspicious activity. 
D. Investigate the sender of the email and communicate with the employee to determine the motives. 

Show Answer

Question # 10

Refer to the exhibit. An HR department submitted a ticket to the IT helpdesk indicating slow performance on an internal share server. The helpdesk engineer checked the server with a real-time monitoring tool and did not notice anything suspicious. After checking the event logs, the engineer noticed an event that occurred 48 hour prior. Which two indicators of compromise should be determined from this information? (Choose two.)

A. unauthorized system modification
 B. privilege escalation 
C. denial of service attack
D. compromised root access 
E. malware outbreak 

Show Answer

Question # 11

A security team received reports of users receiving emails linked to external or unknown URLs that are non- returnable and non-deliverable. The ISP also reported a 500% increase in the amount of ingress and egress email traffic received. After detecting the problem, the security team moves to the recovery phase in their incident response plan. Which two actions should be taken in the recovery phase of this incident? (Choose two.)

 A. verify the breadth of the attack 
B. collect logs 
C. request packet capture 
D. remove vulnerabilities 
E. scan hosts with updated signatures 

Show Answer

Question # 12

Refer to the exhibit. Which type of code created the snippet?

A. VB Script 
B. Python 
C. PowerShell 
D. Bash Script 

Show Answer