Online Access Free 300-215 Exam Questions

Refer to the exhibit.

What is the IOC threat and URL in this STIX JSON snippet?

• A.x4z9arb backdoor;http://x4z9arb.cn/4712/
• B.malware; malware--162d917e-766f-4611-b5d6-652791454fca
• C.malware;
  'http://x4z9arb.cn/4712/'
• D.stix;
  'http://x4z9arb.cn/4712/'
• E.malware; x4z9arb backdoor

Refer to the exhibit.

According to the SNORT alert, what is the attacker performing?

• A.SQL injection attack against the target webserver
• B.brute-force attack against directories and files on the target webserver
• C.brute-force attack against the web application user accounts
• D.XSS attack against the target webserver

An engineer is analyzing a DoS attack and notices that the perpetrator used a different IP address to hide their system IP address and avoid detection. Which anti-forensics technique did the perpetrator use?

• A.onion routing
• B.cache poisoning
• C.encapsulation
• D.spoofing

A security team received reports of users receiving emails linked to external or unknown URLs that are non- returnable and non-deliverable. The ISP also reported a 500% increase in the amount of ingress and egress email traffic received. After detecting the problem, the security team moves to the recovery phase in their incident response plan. Which two actions should be taken in the recovery phase of this incident? (Choose two.)

• A.remove vulnerabilities
• B.scan hosts with updated signatures
• C.verify the breadth of the attack
• D.collect logs
• E.request packet capture

An engineer received a call to assist with an ongoing DDoS attack. The Apache server is being targeted, and availability is compromised. Which step should be taken to identify the origin of the threat?

• A.An engineer should check the server's processes by running commandsps -auxandsudo ps -a
• B.An engineer should check the last hundred entries of a web server with the commandsudo tail -100 /var
  /log/apache2/access.log
• C.An engineer should check the services on the machine by running the commandservice -status-all
• D.An engineer should check the list of usernames currently logged in by running the command$ who | cut
  - d' ' -f1| sort | uniq