300-215 Practice Questions

The eradication phase in incident response involves eliminating the root cause of the incident and

strengthening defenses to prevent reoccurrence. In this case:

Intrusion Prevention System (D): Adding new rules to the IPS to detect and block malicious activity

on TCP/135 is a direct eradication step to remove the threat’s entry point and prevent future attacks.

Centralized User Management (C): Hardening user accounts, removing unnecessary permissions, and

applying tighter authentication/authorization measures helps eliminate the possibility that threat

actors could exploit weak or mismanaged accounts to continue accessing the system.

Although anti-malware software (A) and enterprise block listing (E) are valuable, the most direct

eradication steps here specifically involve managing network access (via IPS) and strengthening user

controls (via centralized user management), especially when TCP/135 (MSRPC endpoint mapper) can

be used to enumerate services and potentially access vulnerable endpoints remotely.

This aligns with best practices outlined in incident response frameworks (such as the NIST SP 800-61

and referenced resources), which emphasize closing the exploited entry points (in this case, TCP/135)

and removing any lingering access points through user management and network control

enhancements.

Reference:

CyberOps Technologies (CBRFIR) 300-215 study guide, Chapter: Understanding the Incident Response

Process, Eradication Phase, page 105-106.

External Reference: “The Core Phases of Incident Response – Remediation,” Cipher blog [1].

External Reference: “Service Overview and Network Port Requirements,” Microsoft documentation

[2].

The exhibit shows multiple ARP reply packets with the same IP addresses (192.168.51.105 and

192.168.51.201) being mapped to different MAC addresses, which triggers the message: "duplicate

use of [IP] detected". This is a strong indicator of an ARP spoofing (or poisoning) attack.

ARP spoofing occurs when a malicious actor sends falsified ARP messages to associate their MAC

address with the IP address of another host. This misleads other devices on the network and allows

interception or redirection of traffic.

The Cisco CyberOps Associate guide specifically recommends configuring port security on switches as

a method to mitigate ARP spoofing, by limiting the number of MAC addresses allowed per port or

statically assigning legitimate MAC addresses to switch ports.

YARA rules are pattern-matching rules used to identify malware based on specific strings, conditions,

and binary patterns. They are most effective in memory or file scans where analysts search for known

indicators or unique signatures via string matching.

Correct answer: C. string matching.

The combination of CPU spikes, disk usage peaks, and fluctuating PageFile.sys indicates excessive

virtual memory paging, which may be a sign of malicious memory or file access behavior.

PageFile.sys is part of the virtual memory system, and analyzing it can reveal which processes or

payloads are consuming unusual amounts of memory, especially during exfiltration events.

During the initial phase of incident response, the two key actions are:

Disconnecting the server (B) to contain the threat and prevent lateral movement or further

exfiltration.

Reviewing network logs (E) to understand the timeline and scope of the attack.

These are emphasized in the containment and detection stages of the incident response lifecycle

outlined in NIST 800-61 and covered in the Cisco CyberOps training.

—

The described scenario includes both internal alerts (unusual network traffic, failed logins, suspicious

file access) and external intelligence indicating active ransomware campaigns in the same industry.

This constitutes a strong combination of precursors and indicators, as defined in the NIST SP 800-61

incident handling model and reinforced in the Cisco CyberOps Associate curriculum.

According to the Cisco guide:

“Once an incident has occurred, the IR team needs to contain it quickly before it affects other

systems and networks within the organization.”

“The containment phase is crucial in stopping the threat from spreading and compromising more

systems”.

Given these indicators and the high-value nature of the data involved, it is essential to proactively

isolate suspected systems and activate the incident response plan to prevent damage from potential

ransomware.

—

The command in the image uses schtasks /create with the ONLOGON schedule and System user

context to execute test.exe. This is a well-documented persistence technique, where an attacker

ensures that a malicious executable is launched automatically at each system logon. This kind of

scheduled task creation aligns with persistence techniques in the MITRE ATT&CK framework (T1053).

—

Steganography is the anti-forensics technique of hiding malicious content within seemingly innocent

files, such as image, audio, or video files. The goal is to conceal data or code in a way that avoids

suspicion and detection, thereby making traditional security inspection tools ineffective unless they

are explicitly designed to detect hidden data within media files.

Steganography differs from encryption because it does not simply make data unreadable; it hides the

existence of the data itself. It is commonly used in cyber operations to hide command-and-control

instructions or to exfiltrate sensitive information in covert ways.

Reference: CyberOps Technologies (CBRFIR) 300-215 study guide, Chapter on Evasion and

Obfuscation Techniques, Anti-Forensics, Steganography Section.

This STIX (Structured Threat Information eXpression) JSON snippet provides two key elements

relevant for IOC (Indicator of Compromise) analysis:

The indicator pattern shows a suspicious URL:

→ "pattern": "[url:value = 'http://x4z9rb.cn/4712/']"

This is the actual IOC that can be used for detection.

The type of object that the indicator relates to:

→ "type": "malware"

→ "name": "x4z9arb backdoor"

This indicates the nature of the threat associated with the IOC is malware.

Therefore, the threat is "malware" and the associated indicator (IOC) is the URL:

http://x4z9rb.cn/4712/

Option A correctly captures both the IOC category ("malware") and the indicator value

("http://x4z9rb.cn/4712/").

Reference: CyberOps Technologies (CBRFIR) 300-215 study guide, Chapter on “Understanding Threat

Intelligence Platforms,” including the use of STIX/TAXII for representing threat data.

Dynamic malware analysis involves executing the malware in a controlled environment to observe its

behavior, such as file creation, network traffic, or system modifications. A sandbox is designed for

this purpose—it safely executes and monitors suspicious code without risking the host system. The

other tools (Decompiler, Unpacker, Disassembler) are primarily used in static analysis.

Correct answer: D. Sandbox

—