Free 300-215 Practice Test

The eradication phase of incident response focuses on eliminating the root cause of the incident and removing all malicious artifacts from the environment. In the given scenario of excessive inbound connection attempts, the playbook's eradication phase would involve two key actions:
1. Removing any potential compromise: The connection attempts may have succeeded in delivering malware. Using anti-malware software is a fundamental step to scan for and remove any malicious code from affected systems.
2. Eliminating the attack vector: To prevent the identified malicious senders from repeating the attack, their IP addresses should be added to a permanent enterprise block list. This action eradicates the specific threat source from being able to access the network.

B. data and workload isolation: This is a containment strategy, not eradication. Its purpose is to limit the spread and impact of an incident, not to remove the threat itself.
C. centralized user management: This is a foundational security control related to identity and access management, typically part of the preparation or hardening phase, not a direct eradication step for this type of incident.
D. intrusion prevention system: An IPS is primarily a tool for detection and containment. While it blocks attacks, its real-time blocking function is considered containment. The permanent rule implementation is better described by block listing.

1. National Institute of Standards and Technology (NIST) Special Publication 800-61 Rev. 2

"Computer Security Incident Handling Guide":

Section 3.4.3

Eradication and Recovery (Page 39): States

"In the eradication phase

the incident response team eliminates the cause of the incident. For example

for a malware incident

the team would remove the malware from infected hosts. They would also identify and mitigate all vulnerabilities that were exploited." This directly supports using anti-malware (A) and mitigating the vulnerability of being accessible to attackers by blocking them (E).

2. Cisco

"Incident Response: How to Fight Back" White Paper:

Section: The Incident Response Process

Eradication (Page 4): Describes this phase as when "the IR team works to eliminate the components of the incident... This could include removing malware

deleting accounts used by the attacker

or identifying and mitigating the vulnerabilities that were exploited." This aligns with removing malware (A) and mitigating the threat by blocking the source (E).

3. Carnegie Mellon University

Software Engineering Institute

"Defining the Building Blocks of a Computer Security Incident Response Team (CSIRT)":

Section 2.3

Incident Handling Life Cycle: This document

which outlines foundational CSIRT concepts

describes eradication as the phase for removing the cause and effects of the incident. This includes "removing malicious code" and "implementing blocks to prevent recurrence from the same source

" which correspond directly to options A and E.

The exhibit displays the output of an ARP table, which shows two different MAC addresses (000c.296a.a21c and 0050.56bd.639c) mapped to the same IP address (10.10.1.1). This is a definitive indicator of an ARP spoofing (or ARP poisoning) attack. In this attack, a malicious actor sends forged ARP messages to link their MAC address with the IP address of a legitimate device, typically the default gateway, to intercept network traffic. Configuring port security on the switch is an effective preventative measure. This feature can be used to restrict a switch port to a specific, legitimate MAC address. When configured, any frames arriving on the port with a different source MAC address will be dropped, thus preventing the attacker's spoofed ARP packets from being processed.

A. DNS spoofing; encrypt communication protocols: The exhibit shows a Layer 2 ARP table issue, not a DNS resolution problem. DNS spoofing targets the domain name system.
B. SYN flooding; block malicious packets: SYN flooding is a Layer 4 Denial-of-Service (DoS) attack that exhausts server resources with TCP SYN packets, which is unrelated to the ARP table manipulation shown.
D. MAC flooding; assign static entries: The attack shown is a targeted ARP spoof against a single IP, not MAC flooding, which involves overwhelming the switch's CAM table with many random MAC addresses.

1. Cisco Systems, Inc. (2023). Catalyst 9300 Series Switches, IOS XE Cupertino 17.9.x, Security Configuration Guide. "Configuring Port Security" section. This guide details how port security restricts port access to authorized MAC addresses. It states, "You can use port security to limit the number of MAC addresses and restrict the MAC addresses on a port." This mechanism directly blocks frames from an unauthorized MAC, such as one used in an ARP spoofing attempt.

2. Cisco Systems, Inc. (2023). Catalyst 9300 Series Switches, IOS XE Cupertino 17.9.x, Security Configuration Guide. "Configuring DHCP Features and IP Source Guard" section, subsection "Information About Dynamic ARP Inspection". This document defines ARP spoofing: "ARP spoofing is an attack in which a host sends gratuitous ARP responses that specify the MAC address of the attacking host for an IP address so that the attacking host can intercept data for that IP address." This confirms the attack vector seen in the exhibit.

3. Odom, W. (2016). CCNP ROUTE 300-101 Official Cert Guide. Cisco Press. Chapter 2, "Fundamental EIGRP Concepts," section "Layer 2 and 3 Addressing on a LAN." While focused on routing, foundational networking texts explain that the ARP table's purpose is to map Layer 3 IP addresses to Layer 2 MAC addresses. The anomaly in the exhibit—one IP mapping to two MACs—is a clear violation of this principle, pointing directly to ARP manipulation.

YARA is a tool designed to identify and classify malware based on pattern matching. The core of a YARA rule consists of a strings section, where textual or binary patterns are defined, and a condition section that specifies the logic for a match. When an analyst uses YARA to scan memory, the tool systematically searches the entire memory space for occurrences of these predefined strings. Therefore, the fundamental task being completed is string matching to identify indicators of compromise or malicious artifacts residing in memory.

A. deobfuscation: This is the process of reversing obfuscation to make code readable. While it may be a precursor to a scan, it is not the mechanism YARA itself uses to scan.
B. XML injection: This is a web application attack vector used to manipulate or compromise the logic of an XML application or service; it is unrelated to YARA's function.
D. data diddling: This is a type of attack involving the unauthorized alteration of data before or during its entry into a system, not a method for memory analysis.

1. Official Vendor Documentation: VirusTotal

YARA Documentation Release 4.5.0

"Writing YARA Rules

" Section 3. The documentation explicitly states

"Each rule starts with the keyword rule followed by a rule identifier... The body of the rule contains a strings definition section and a condition section. The strings section is where you define the strings that will be looked for in the file or process." This confirms the core mechanism is defining and matching strings.

(Source: https://yara.readthedocs.io/en/stable/writingrules.html)

2. Official Vendor Documentation: Cisco

Cisco Secure Endpoint User Guide

"Custom Detections

" Section: "YARA." The guide describes how to use YARA for custom detections by creating rules that look for specific string patterns. For example

"A YARA rule is a description that is based on textual or binary patterns." This reinforces that its operational principle is pattern/string matching.

(Source: Cisco Secure Endpoint documentation

specific version guides detail this feature).

3. Peer-Reviewed Academic Publication: Cohen

M. (2015). Chapter 10 - Yara: A Pattern Matching Tool for Incident Responders and Malware Analysts. In Malware Analyst's Cookbook and DVD. This chapter

widely referenced in academic and professional contexts

details YARA's architecture and primary use case as a powerful string and pattern matching engine for identifying malware families.

(Note: While a book

its chapters are often treated as peer-reviewed articles in this domain and used in university courseware).

The combination of symptoms—high page faults, changes to PageFile.sys, and correlated disk and CPU spikes—are classic indicators of a condition known as "thrashing." This occurs when the system's physical memory (RAM) is exhausted, forcing the operating system to excessively swap memory pages to and from the virtual memory file (PageFile.sys) on the disk. This heavy I/O activity causes the performance degradation. In an incident response context, this behavior is highly suspicious and could be caused by a malicious process staging large amounts of data (e.g., from the database) in memory before exfiltration. Analyzing the virtual memory configuration and the page file is the most direct way to identify the offending process and potentially recover forensic artifacts.

A. Reviewing database logs is a secondary action. The symptoms point to an OS-level memory contention issue causing the database unresponsiveness, not an intrinsic database error.
B. system.cfg is not a standard, critical Windows configuration file. The symptoms indicate a dynamic, runtime problem, not a static system misconfiguration.
D. A Memory.dmp file is a system crash dump. The scenario describes an unresponsive server, not one that has crashed (i.e., generated a Blue Screen of Death). ---

1. Official Vendor Documentation (Microsoft):

Microsoft Corporation. (2023). Troubleshoot high-memory-usage issues. Microsoft Learn. This document explains how to use tools like Performance Monitor to diagnose memory issues by observing counters such as Page Faults/sec. It directly links high page faults to insufficient memory and the use of the page file

validating the analysis of the symptoms. (Reference Section: "Collect data").

Microsoft Corporation. (2023). Overview of memory management. Microsoft Learn. This document details the role of the Virtual Memory Manager (VMM) and the page file (Pagefile.sys) in Windows

providing the foundational knowledge that changes to this file and high fault rates are central to memory pressure analysis. (Reference Section: "Pagefiles").

2. Official Vendor Documentation (Cisco):

Cisco Systems

Inc. (2016). Incident Response: Live Data Collection from Windows Systems. Cisco White Paper. This guide outlines critical data to collect from live Windows systems during an incident. It emphasizes collecting information about running processes

memory usage

and network connections to identify malicious activity

which aligns with investigating the process causing the memory pressure described in the scenario. (Reference Section: "Volatile Data Collection Procedure

" Step 4: "Processes").

3. University Courseware / Reputable Institution:

Hogan

M. (2012). Remnants of an Attack: A Pagefile Analysis. SANS Institute InfoSec Reading Room. This SANS Gold paper

a resource used in advanced cybersecurity education

details the forensic value of Pagefile.sys. It explains that the page file can contain fragments of data

passwords

and other artifacts from running processes

making its analysis crucial during an investigation involving data staging or exfiltration. (Reference Section: "What is the Pagefile and Why Do We Care?").

The initial assessment phase of incident response focuses on validating the incident, understanding its immediate scope, and taking urgent steps to prevent further damage. Reviewing network logs (E) is a fundamental analysis task to confirm the intrusion, identify the timeline, and search for related indicators of compromise (IoCs). Concurrently, disconnecting the compromised server from the network (B) is a critical containment action. Given the high confidence of compromise (communication with a known malicious IP), this step is taken immediately to stop malicious activity, prevent data exfiltration, and halt potential lateral movement across the network.

A. Notifying law enforcement agencies is a decision made after the incident's scope and impact are better understood, and it typically involves management and legal counsel.
C. A comprehensive forensic analysis is part of a deeper investigation phase that occurs after initial containment, not during the rapid initial assessment.
D. Interviewing employees is a valid investigative step but is secondary to the immediate technical analysis of logs and containment of the active threat.

1. NIST Special Publication 800-61 Rev. 2, "Computer Security Incident Handling Guide": This guide outlines the incident response lifecycle. The "Detection & Analysis" phase involves analyzing data (like logs) to confirm an incident. The subsequent "Containment, Eradication, & Recovery" phase begins with containment. The guide states, "Containment is the first step in recovery... containment provides time for developing a tailored remediation strategy." (Section 3.3.1, Page 25). The initial assessment informs the immediate need for containment, making both actions critical at the start of the response.

2. Cisco, "Security Incident Response": Official Cisco documentation on their incident response services emphasizes a phased approach. The "Triage" or "Analysis" phase involves "reviewing available data, such as logs... to determine the nature of the event." The "Containment" phase, which happens immediately after or in parallel, aims to "stop the current impact of the incident and prevent it from spreading further." Disconnecting a host is a primary containment technique. (Reference: Cisco Incident Response Service At-a-Glance document).

3. Carnegie Mellon University, Software Engineering Institute, "Defining Incident Management Processes for CSIRTs": This document describes the incident handling process. The "Analyze" step involves gathering information from logs and other sources to characterize the incident. The "Contain" step, which follows immediately, is described as actions to "stop the incident from causing further damage." (Section 3.2, "A High-Level View of the Incident Management Process"). This supports the tight coupling of initial analysis (log review) and immediate containment (disconnection).

The scenario presents multiple, correlated indicators of compromise (IoCs) that align with both internal observations and external threat intelligence. The combination of unusual network traffic, a spike in failed logins, and suspicious file access, when contextualized with an active ransomware campaign targeting the industry, strongly suggests an ongoing attack. According to standard incident response frameworks, the immediate priority is to contain the threat to prevent further damage and lateral movement. Isolating affected systems is a critical containment step, and activating the formal incident response plan ensures a structured, coordinated, and effective reaction to the security incident.

A. Passive monitoring is a negligent response, as the correlated indicators strongly suggest an active threat, not a coincidence, requiring immediate action to mitigate risk.
C. While valuable for long-term prevention, user training is not an appropriate immediate response to what appears to be an active, malicious intrusion.
D. Dismissing multiple, strong, and contextualized threat indicators as "normal" without investigation is a critical error that could lead to a catastrophic breach.

1. NIST Special Publication 800-61 Rev. 2, Computer Security Incident Handling Guide. Section 3.2, "Containment, Eradication, & Recovery," states, "Containment is the first step in recovery... an essential part of the process is to make a decision on the most effective strategy for containing the incident." Section 3.2.2, "Containment Strategy," further details that containment actions can include isolating a network segment or disconnecting individual systems. This supports isolating systems and activating the plan.

2. Cisco, "Threat-Centric Incident Response Playbook" (2017). The playbook emphasizes the importance of moving from detection to containment swiftly. In the "Containment" phase (p. 10), it outlines actions such as "Isolate the host from the network" and "Block malicious IP addresses" as primary steps after identifying a credible threat, which aligns directly with the recommended action.

3. Carnegie Mellon University, Software Engineering Institute, "Defining Incident Response" (2017). This document outlines the incident response lifecycle. The "Analysis" phase involves correlating data from multiple sources (as the analyst has done). The immediate next step is "Containment," described as actions taken to "stop the incident from causing further damage," which validates the need to isolate systems and formally manage the response. (Reference: CERT/CC, Incident Management Team).

The exhibit displays the use of the Windows command-line utility schtasks to create a new scheduled task. The command schedules a program named malware.exe to execute (/tr) every time a user logs on (/sc onlogon). This task, deceptively named "SecurityScan" (/tn), is configured to run with the highest level of privilege on the local system (/ru System). This is a classic persistence technique used by threat actors to ensure their malicious payload automatically runs after a system reboot or user logoff, thereby maintaining their foothold on the compromised machine.

A. The command schedules an executable; it does not provide any information about whether the code within that executable is obfuscated.
B. This command uses the Task Scheduler service. It does not directly modify persistence-related registry keys, such as the Run keys.
C. The command configures a local task on the current machine. It does not involve the Remote Desktop Protocol (RDP) or lateral movement to other systems.

1. MITRE ATT&CK® Framework, "Technique T1053.005: Scheduled Task," MITRE Corporation. This source directly identifies the use of schtasks.exe as a primary method for adversaries to schedule the recurring execution of malicious code for persistence. The example command in the exhibit is a textbook implementation of this technique.

2. Microsoft Corporation, "schtasks create," Microsoft Docs. The official vendor documentation confirms that schtasks /create is used to schedule a command or program to run periodically or at a specific time. The /sc onlogon parameter is explicitly defined as running the task whenever any user logs on.

3. Cisco Talos Intelligence Group, "Threat Spotlight: A deep dive into the Loda RAT," Cisco Talos Blog, August 26, 2020. In the "Persistence" section, this official Cisco security publication describes how malware like the Loda RAT achieves persistence by creating a scheduled task, demonstrating that this is a recognized technique tracked by Cisco's threat intelligence teams.

Steganography is the practice of concealing data within another non-secret file or message to avoid detection. The primary goal is to hide the very existence of the secret data. In the context of anti-forensics, an attacker embeds malicious code or stolen data within an ordinary-looking carrier file, such as an image, audio, or video file. This carrier file can then be exfiltrated or stored on a system without raising suspicion, as forensic tools may not initially identify the hidden content. The technique relies on the carrier medium appearing completely normal to casual observation and initial digital forensic analysis.

A. This describes hiding data in file system slack space or unallocated clusters, a different anti-forensics technique, not steganography.
B. This is file signature manipulation (or magic number modification), an obfuscation method to disguise a file's true type from analysis tools.
C. This describes network tunneling or encapsulation, where data is hidden within the payload of another network protocol (e.g., DNS, ICMP).

1. Official Vendor Documentation (NIST): National Institute of Standards and Technology (NIST)

Special Publication 800-86

Guide to Integrating Forensic Techniques into Incident Response. Section 3.3.3

"Data Hiding

" states: "Steganography is a technique for hiding data within another file... The original file is known as the carrier file

and the combination of the carrier file and the hidden file is the steganography file." This directly supports the concept of concealing files in ordinary places.

2. Official Vendor Documentation (Cisco): Cisco Press

CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide. Chapter 21

"Forensics

" under the "Anti-Forensic Techniques" section

defines steganography as "the science of hiding information

which allows for the existence of the information to be concealed." This aligns with the chosen answer.

3. Academic Publication: Provos

N.

& Honeyman

P. (2003). Hide and Seek: An Introduction to Steganography. IEEE Security & Privacy

1(3)

32-44. The paper defines steganography as "the art and science of communicating in a way which hides the existence of the communication." This core principle is accurately reflected in option D. DOI: https://doi.org/10.1109/MSECP.2003.1203220

The provided JSON snippet represents a STIX (Structured Threat Information Expression) indicator object. The threat type is identified through the indicatortypes and description fields. The indicatortypes value is malicious-activity, and the description specifies the activity is part of the "x4z9arb backdoor," which is a type of malware. Therefore, "malware" is the correct threat category. The specific Indicator of Compromise (IOC) is defined in the pattern field, which uses STIX patterning to specify a URL object. The value of this URL is explicitly stated as 'http://x4z9arb.cn/4712/'.

B. "x4z9arb backdoor" is the name of the malware mentioned in the description, not the URL specified in the pattern.
C. While "x4z9arb backdoor" is the specific threat, "malware" is the broader, more standard threat category appropriate for this indicator.
D. The value malware--162d917e-766f-4611-b5d6-652791454fca is a STIX identifier (ID) for a malware object, not a URL.
E. "stix" is the value of the patterntype field, indicating the language used for the pattern, not the threat itself.

1. OASIS Committee Specification

"STIX Version 2.1":

Section 5.2

Indicator Object: This section defines the properties of a STIX Indicator.

Property 5.2.4

indicatortypes: Describes the type of indicator. The value malicious-activity is a valid entry from the indicator-type-ov open vocabulary.

Property 5.2.7

pattern: "The pattern that defines the indicator." In the exhibit

the pattern [url:value = 'http://x4z9arb.cn/4712/'] identifies a URL Cyber-observable Object as the IOC.

2. Cisco

"Cisco Security

Threat Intelligence Director Deployment Guide":

Chapter: STIX Objects

Section: Indicator: This guide explains how Cisco products utilize STIX objects. It clarifies that an Indicator object contains a pattern

such as a URL or IP address

that can be used to detect malicious activity. This aligns with the question's exhibit where a URL is the pattern.

3. P. Tounsi and H. Fouchal

"STIX/TAXII for Cyber Threat Intelligence (CTI) Sharing: A Survey

" in IEEE Access

vol. 9

2021:

Section III-A

STIX Domain Objects (SDOs): This academic paper reviews STIX components

describing the Indicator object as a pattern of properties and values that can identify malicious activity. It confirms that the pattern property contains the technical IOC

such as the URL in the exhibit. (DOI: https://doi.org/10.1109/ACCESS.2021.3053229

pp. 19239-19240).

Dynamic malware analysis involves executing the malware in a controlled, isolated environment to observe its behavior in real-time. A sandbox is a security mechanism specifically designed for this purpose. It allows analysts to safely run suspicious code and monitor its actions, such as file system modifications, registry changes, process creation, and network communications, without risk to the host system or network. This behavioral analysis is the core of the dynamic approach.

A. Decompiler: This is a static analysis tool used to translate compiled, low-level machine code back into a higher-level programming language, allowing for code review without execution.
B. Unpacker: This is a utility used during the preparatory phase of static analysis to reverse the compression or obfuscation applied to malware, revealing its original code for examination.
C. Disassembler: This is a fundamental static analysis tool that converts machine code into human-readable assembly language, enabling an analyst to inspect the program's instructions without running it. ---

1. Cisco Systems

Inc.

"Cisco Secure Malware Analytics (Threat Grid) Data Sheet". Cisco.com. Accessed 2023. In the "Product overview" section

it states: "Cisco Secure Malware Analytics is a cloud-based malware analysis and threat intelligence platform. It combines static and dynamic malware analysis with threat intelligence into one solution." It further details that the dynamic analysis occurs within its sandbox environment to observe malware behavior.

2. Sikorski

M.

& Honig

A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press. In Chapter 1

"Basic Analysis

" the text clearly distinguishes between static and dynamic analysis techniques. Sandboxes are presented as a primary tool for automated dynamic analysis (p. 15)

while disassemblers and decompilers are categorized under static analysis tools (p. 14).

3. Egele

M.

Scholte

T.

Kirda

E.

& Kruegel

C. (2008). "A survey on automated dynamic malware analysis techniques and tools." ACM Computing Surveys (CSUR)

44(2)

1-42. Section 2

"Dynamic Analysis

" defines the process: "The basic idea of dynamic analysis is to execute the malware in a safe environment and monitor its actions... Such a controlled environment is often called a sandbox." (p. 6:3). https://doi.org/10.1145/2089125.2089126