Cisco Conducting Forensic Analysis & Incident Response Using Cisco Technologies for CyberOps - 300-215

An attacker embedded a macro within a word processing file opened by a user in an organization's legal department. The attacker used this technique to gain access to confidential financial data. Which two recommendations should a security expert make to mitigate this type of attack? (Choose two.)

• A. signed macro requirements
• B. network access control
• C. firewall rules creation
• D. removable device restrictions
• E. controlled folder access

An organization experienced a sophisticated phishing attack that resulted in the compromise of confidential information from thousands of user accounts. The threat actor used a land and expand approach, where initially accessed account was used to spread emails further. The organization ' s cybersecurity team must conduct an in-depth root cause analysis to uncover the central factor or factors responsible for the success of the phishing attack. The very first victim of the attack was user with email [email protected]. The primary objective is to formulate effective strategies for preventing similar incidents in the future. What should the cybersecurity engineer prioritize in the root cause analysis report to demonstrate the underlying cause of the incident?

• A. examination of the organization ' s network traffic logs to identify patterns of unusual behavior leading up to the attack
• B. comprehensive analysis of the initial user for presence of an insider who gained monetary value by allowing the attack to happen
• C. evaluation of the organization ' s incident response procedures and the performance of the incident response team
• D. investigation into the specific vulnerabilities or weaknesses in the organization ' s email security systems that were exploited by the attackers

Which tool should an investigator use to extract information about running processes from RAM?

• A. Sleuth Kit with Autopsy
• B. SANS SIFT
• C. Linux dd
• D. Volatility

What is the steganography anti-forensics technique?

• A. concealing malicious files in ordinary or unsuspecting places
• B. hiding a section of a malicious file in unused areas of a file
• C. sending malicious files over a public network by encapsulation
• D. changing the file header of a malicious file to another file type

During a routine inspection of system logs, a security analyst notices an entry where Microsoft Word initiated a PowerShell command with encoded arguments. Given that the user ' s role does not involve scripting or advanced document processing, which action should the analyst take to analyze this output for potential indicators of compromise?

• A. Confirm that the Microsoft Word license is valid and the application is updated to the latest version.
• B. Validate the frequency of PowerShell usage across all hosts to establish a baseline.
• C. Review the encoded PowerShell arguments to decode and determine the intent of the script.
• D. Monitor the Microsoft Word startup times to ensure they align with business hours.