Refer to the exhibit. Which two actions should be taken based on the intelligence information? (Choose two.)
Correct Answer: B,D
The STIX intelligence feed in the exhibit identifies specific malicious domains, such as: fightcovid19.shop nocovid19.shop stopcovid19.shop These are categorized as "Malicious FQDN Indicator." The recommended cybersecurity actions when such threat intelligence is received are: D). Block network access to identified domains: This directly prevents users or systems from communicating with known malicious infrastructure and is a critical first step in threat mitigation. B). Add a SIEM rule to alert on connections to identified domains: This ensures that any attempted communication with these domains is flagged for immediate review and action, enabling real-time threat detection and incident response. Blocking all .shop domains (Option A or C) would be overbroad and potentially disruptive, as many legitimate websites also use that TLD. Option E (routing to block hole) could be valid as a DNS strategy, but B and D represent the most actionable and precise responses per standard incident response practices. Reference: CyberOps Technologies (CBRFIR) 300-215 study guide, Chapter on "Threat Intelligence Platforms," covering how to operationalize STIX/TAXII indicators via blocking and SIEM integration.
300-215 Exam Question 57
A cybersecurity analyst must evaluate files from an endpoint in an enterprise network. The antivirus software on the endpoint flagged a suspicious file during a routine scan On initial evaluation the file did not match any known signatures in the antivirus database, but exhibited unusual network behavior during dynamic analysis Which step should the analyst take next?
Correct Answer: D
300-215 Exam Question 58
Which code snippet reflects Python 2.7 syntax-based reverse-shell code?
Correct Answer: C
Option C uses Python modules and syntax valid in Python 2.7: it imports socket, subprocess, and os; creates an IPv4 TCP stream socket; connects to a remote IP address and port; duplicates the socket descriptor onto standard input, output, and error; and launches an interactive /bin/sh. That redirection gives the remote listener command execution, which is the defining behavior of a reverse shell. The other snippets are recognizable as Ruby, Perl, and PHP implementations respectively. CBRFIR Forensics Techniques objective 2.4 requires determining the type of code from a provided snippet, while process and network analysis should verify any inferred behavior. Python's official documentation confirms that AF_INET uses a host-and-port tuple and that SOCK_STREAM creates a stream socket. Analysts should treat the code as evidence and never execute it outside an isolated laboratory. Python 2.7 socket documentation
300-215 Exam Question 59
An e-commerce company recently suffered a ransomware attack and severe financial losses. Cost-cutting resulted in the accidental sale of its on-premises log-aggregation system, nonrenewal of automated patching subscriptions and security tools, and a 70% reduction in Security and IT staffing despite unchanged infrastructure. Management intends to redeploy log aggregation using IaaS. Which cloud service model should the security team recommend during its discussion with leadership?
Correct Answer: A
SaaS is the appropriate model because the organization lacks the personnel and tooling needed to operate another infrastructure-heavy logging platform. With SaaS, the provider operates the application and underlying platform, including service maintenance and infrastructure patching, while the customer configures collection, retention, access, alerting, and integrations. IaaS would leave the company responsible for guest operating systems, deployed applications, storage configuration, and much of the security workload-the exact responsibilities its reduced team cannot sustain. PaaS is a general application-hosting model, not a service inherently dedicated to log aggregation. DaaS does not guarantee automatic collection of every endpoint log. NIST's cloud model distinguishes SaaS from IaaS by the amount of underlying infrastructure and software the consumer manages. The recommendation also supports CBRFIR's focus on cloud-native logs and sustainable incident-response capability. NIST cloud service-model synopsis
300-215 Exam Question 60
Refer to the exhibit. A network administrator creates an Apache log parser by using Python. What needs to be added in the box where the code is missing to accomplish the requirement?
Correct Answer: D
The goal of the given Python code is to parse an Apache access log and extract IP addresses using regular expressions (regex). In this context, the most appropriate regex pattern to extract IPv4 addresses from log data is: r ' \d{1,3}.\d{1,3}.\d{1,3}.\d{1,3} ' This pattern matches typical IPv4 addresses, where each octet consists of 1 to 3 digits separated by periods. For example, it matches addresses like 192.168.1.1 or 10.0.0.123. The pattern uses: \d{1,3} to capture between 1 and 3 digits, \. to match the dot (escaped since . is a special character in regex), repeated 4 times with proper separation to form the full IPv4 structure. Options A, B, and C either include incorrect syntax, improper escape sequences, or do not represent a valid IP address pattern. This type of log analysis and pattern extraction is described in the Cisco CyberOps Associate curriculum under basic scripting and automation techniques used in log and artifact analysis. Reference: CyberOps Technologies (CBRFIR) 300-215 study guide, Section: "Basic Python Scripting for Security Analysts" and "Log Analysis and Data Extraction using Regex."
