300-215 exam dumps

300-215 practice question 76 of 229

Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity. Professional level, Cisco. Free question with the correct answer and a full explanation.

300-215 Question 76

Select 4

While analyzing a SIEM alert, you notice unusual outbound traffic from a specific host to an unfamiliar IP address. You decide to investigate further using malware analysis tools and forensic techniques. Which Indicators of Compromise (IOCs) would confirm the host is compromised?

  1. A

    Presence of a known malicious hash in the host's file system

  2. B

    Unusual login attempts from a foreign IP in the authentication logs

  3. C

    Frequent failed DNS resolutions to known malicious domains

  4. D

    Consistent high CPU usage caused by a legitimate system process

  5. E

    A process running on the host communicating with a blacklisted IP address

Show answer and explanation

Correct answers: A, B, C, E

Explanation

Indicators of Compromise (IOCs) help identify if a host has been compromised during forensic analysis. Malicious file hashes, unusual authentication logs, failed DNS resolutions to malicious domains, and communication with blacklisted IPs are all strong indicators. Identifying these through SIEM and malware analysis tools can confirm the compromise. High CPU usage, on the other hand, is not inherently suspicious without additional context.

  • A. Correct.

    Malware analysis tools can identify malicious file hashes, which are strong Indicators of Compromise (IOCs). This is a valid IOC for confirming compromise.

  • B. Correct.

    Unusual login attempts from foreign IPs can indicate unauthorized access attempts or brute force attacks. This is a valid IOC.

  • C. Correct.

    Failed DNS resolutions to known malicious domains suggest the host might be attempting to contact a Command and Control (C2) server. This is a valid IOC.

  • D. Incorrect.

    Consistent high CPU usage could be caused by legitimate processes, and without further evidence, it is not a definitive IOC.

  • E. Correct.

    A process communicating with a blacklisted IP address strongly indicates malicious behavior and is a valid IOC.

Timed practice exam

Take a 300-215 practice test under exam conditions

75 questions in 120 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam