300-215 practice questions 21–28

1. Question 21 · 28 in bank

   An engineer received a call to assist with an ongoing DDoS attack. The Apache server is being targeted, and availability is compromised. Which step should be taken to identify the origin of the threat?

   • AAn engineer should check the list of usernames currently logged in by running the command $ who | cut ""d' "˜ -f1| sort | uniq
   • BAn engineer should check the server's processes by running commands ps -aux and sudo ps -a.
   • CAn engineer should check the services on the machine by running the command service -status-all.
   • DAn engineer should check the last hundred entries of a web server with the command sudo tail -100 /var/log/apache2/access.log.

   Show answer

   Answer: D

   Next question

2. Question 22 · 28 in bank

   

   Refer to the exhibit. According to the SNORT alert, what is the attacker performing?

   • Abrute-force attack against the web application user accounts
   • BXSS attack against the target webserver
   • Cbrute-force attack against directories and files on the target webserver
   • DSQL injection attack against the target webserver

   Show answer

   Answer: C

   Next question

3. Question 23 · 28 in bank

   Select 2

   

   Refer to the exhibit. Which two actions should be taken as a result of this information? (Choose two.)

   • AUpdate the AV to block any file with hash "cf2b3ad32a8a4cfb05e9dfc45875bd70".
   • BBlock all emails sent from an @state.gov address.
   • CBlock all emails with pdf attachments.
   • DBlock emails sent from [email protected] with an attached pdf file with md5 hash "cf2b3ad32a8a4cfb05e9dfc45875bd70".
   • EBlock all emails with subject containing "cf2b3ad32a8a4cfb05e9dfc45875bd70".

   Show answer

   Answer: AB

   Next question

4. Question 24 · 28 in bank

   

   Refer to the exhibit. What should be determined from this Apache log?

   • AA module named mod_ssl is needed to make SSL connections.
   • BThe private key does not match with the SSL certificate.
   • CThe certificate file has been maliciously modified
   • DThe SSL traffic setup is improper

   Show answer

   Answer: D

   Next question

5. Question 25 · 28 in bank

   What are YARA rules based upon?

   • Abinary patterns
   • BHTML code
   • Cnetwork artifacts
   • DIP addresses

   Show answer

   Answer: A

   Next question

6. Question 26 · 28 in bank

   An engineer is analyzing a ticket for an unexpected server shutdown and discovers that the web-server ran out of useable memory and crashed. Which data is needed for further investigation?

   • A/var/log/access.log
   • B/var/log/messages.log
   • C/var/log/httpd/messages.log
   • D/var/log/httpd/access.log

   Show answer

   Answer: B

   Next question

7. Question 27 · 28 in bank

   

   Refer to the exhibit. An employee notices unexpected changes and setting modifications on their workstation and creates an incident ticket. A support specialist checks processes and services but does not identify anything suspicious. The ticket was escalated to an analyst who reviewed this event log and also discovered that the workstation had multiple large data dumps on network shares. What should be determined from this information?

   • Adata obfuscation
   • Breconnaissance attack
   • Cbrute-force attack
   • Dlog tampering

   Show answer

   Answer: D

   Next question

8. Question 28 · 28 in bank

   

   Refer to the exhibit. A company that uses only the Unix platform implemented an intrusion detection system. After the initial configuration, the number of alerts is overwhelming, and an engineer needs to analyze and classify the alerts. The highest number of alerts were generated from the signature shown in the exhibit. Which classification should the engineer assign to this event?

   • ATrue Negative alert
   • BFalse Negative alert
   • CFalse Positive alert
   • DTrue Positive alert

   Show answer

   Answer: C

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-215 practice, question 21. 28 questions available.