Free Cisco 300-215 Exam Dumps Questions & Answers

Refer to the exhibit.

An engineer analyzes a suspicious email. Which two actions should be taken? (Choose two.)

• A.  Update the antivirus system to block files using a SHA128 hash.
• B.  Block every email containing a document attachment because attackers frequently use documents for initial access.
• C.  Block emails that contain the text xsi:type= " stIxVocabs:IndicatorTypeVocab-1.1 " in the subject.
• D.  Block all incoming emails from the malicious domain site.org, and review the block later to revalidate it.
• E.  Update the antivirus system to block files with SHA-256 hashef537f25c895bfa782526529a9b63d97aa631564d5d789c2b765448c8635fb6c.

During an overnight shift, a cybersecurity team at a global trading firm detects irregular activity The network intrusion system flags an encrypted traffic spike from high-value transaction servers to an anonymous Tor exit node Simultaneously, internal surveillance tools report unusual database queries and access patterns resembling exfiltration techniques Which focused action should the team take first to analyze and address these potential security threats?

• A.  Implement dynamic firewall rules to block suspicious outbound connections
• B.  Cross-reference database access logs with user activity profiles
• C.  Initiate immediate containment protocols tor transaction servers.
• D.  Engage advanced decryption and anomaly analysis for the flagged traffic

Refer to the exhibit. What is the result of this Bash script?
#!/bin/bash
logfile1=/var/log/messages
logfile2=/var/log/secure
mydatexpr=`date +%b\ %d`
for log in $logfile{1,2}
do
echo $log BEGIN
egrep " $mydatexpr " $log
echo $log END
done

• A.  It creates a date-and-time entry in a log file.
• B.  It parses events by date and time from a log file.
• C.  It searches for a particular date in a log file.
• D.  It modifies the time format in a log file.

Refer to the exhibit.

Which type of attack is occurring?

• A.  Man-in-the-middle attack
• B.  Distributed denial-of-service attack
• C.  ARP spoofing
• D.  Phishing

A company's security engineer notices through the SIEM that an employee's workstation sent several DNS requests involving the external IP address of the suspicious domain a4sn77d8z3dsci9416cov.com. After investigating multiple log sources, the security team determines that the employee downloaded an infected PDF file through a URL in an email. Which two elements must be included in the root cause analysis report?
(Choose two.)

• A.  Malicious insider
• B.  Malware with a command-and-control callback
• C.  DNS requests to the external IP address
• D.  Phishing attempt
• E.  Suspicious domain