300-215 Practice Questions

This is the correct and most efficient command. grep is the standard tool for searching text. The pattern "\.pw" correctly escapes the dot, ensuring it is treated as a literal character rather than a wildcard, thus preventing false positives for strings like somepw.com. It reads the log file and redirects the output to the specified text file.

Writing files to protected system directories like System32 is a highly suspicious activity and a strong indicator of malware attempting to install components or establish persistence. This is a critical behavioral indicator.

Network communication with a known malicious entity, such as a botnet command-and-control server, is one of the most severe indicators. It confirms the malware is active and attempting to receive commands or exfiltrate data, requiring immediate incident response.

The core challenge in IaaS forensics is the lack of physical access. Investigators cannot seize a physical server or directly access the hypervisor layer, which is managed by the cloud provider. This prevents traditional forensic techniques like cold-boot attacks or direct memory acquisition from the host machine, forcing reliance on provider APIs and logs.

The CIM (Common Information Model) repository is the database that stores WMI objects, including classes and instances. Malicious persistence mechanisms created via WMI event subscriptions are stored as instances of the __EventFilter, __EventConsumer (e.g., ActiveScriptEventConsumer), and __FilterToConsumerBinding classes within this database. Analyzing the OBJECTS.DATA file in this directory is essential for this investigation.

The SOAR platform has received high-confidence intelligence that the source IP is malicious. The most logical, automated, and effective response is to immediately block this IP at the network perimeter (the firewall) to stop the brute-force attack and prevent any further malicious activity from that source.

Transmogrification is the specific term for altering a file's header or magic numbers to disguise its actual file type. This technique attempts to trick automated analysis tools and forensic investigators who rely on file signatures for initial identification.

The statement is false. Examining a file without executing it is the definition of static analysis. The strings command reads the binary file from disk to extract printable character sequences. This does not involve running the code, so it is a form of static, not dynamic, analysis.

Deploying a virtual patch on the IPS is the best immediate action. This technique uses the IPS to inspect traffic and block the specific malicious pattern (the SQL injection attempt) before it reaches the vulnerable server. This mitigates the risk without taking the server offline (which causes business impact) or only blocking a single source IP (which the attacker can easily change). Shutting down the database is a last resort and highly disruptive.

The most effective way to stop a brute-force attack against a cloud instance is to restrict network access. Modifying the Security Group to allow RDP traffic only from known, trusted IP addresses immediately cuts off the attackers. Additionally, for administrative access, using a bastion host or AWS Systems Manager provides a more secure, audited, and controlled access method than exposing RDP directly to the internet.

The most effective way to stop a brute-force attack against a cloud instance is to restrict network access. Modifying the Security Group to allow RDP traffic only from known, trusted IP addresses immediately cuts off the attackers. Additionally, for administrative access, using a bastion host or AWS Systems Manager provides a more secure, audited, and controlled access method than exposing RDP directly to the internet.

The most critical and immediate action for a confirmed high-fidelity alert on a critical server is containment. Using a SOAR playbook to trigger Cisco Secure Endpoint's host isolation feature is the fastest and most effective way to prevent lateral movement or further malicious activity from the compromised host. While blocking the IP is a good step, it doesn't stop the malware on the host from attempting to communicate with other internal systems. A vulnerability scan is too slow and does not address the active threat.