I85PREP
⌘ K
Cisco 300-215 CBRFIR study materials
Cisco 300-215 CBRFIR study resources

Cisco 300-215 CBRFIR practice questions

One question at a time. Build your Cisco 300-215 CBRFIR understanding.

First 50 of 198 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Undetermined - official content domains not enumerated in the retrieved source

In a Cisco incident response workflow, which phase immediately follows detection and validation of a security event?

  1. Eradication
  2. Containment Correct answer.
  3. Lessons learned
  4. Recovery

Explanation

The NIST-style incident response lifecycle moves from preparation and detection/analysis into containment, eradication, recovery, and post-incident activity. Containment limits the spread and impact of the incident before the threat is removed.

Question 2Undetermined - official content domains not enumerated in the retrieved source

Which Cisco security product is primarily used to correlate telemetry across network, endpoint, and cloud sources for threat investigation?

  1. Cisco Secure Firewall Management Center
  2. Cisco Secure Network Analytics Correct answer.
  3. Cisco Umbrella
  4. Cisco Identity Services Engine

Explanation

Cisco Secure Network Analytics (formerly Stealthwatch) uses flow telemetry and behavioral analytics to detect and investigate threats across the network. It is designed for cross-segment visibility and correlation rather than policy enforcement.

Question 3Undetermined - official content domains not enumerated in the retrieved source

An analyst sees repeated failed logins followed by a successful login from an unusual country for a privileged account. Which activity best describes this pattern?

  1. Denial of service
  2. Ransomware staging
  3. Credential stuffing leading to account takeover Correct answer.
  4. Watering hole attack

Explanation

Many failed authentications followed by success from an anomalous location is the classic signature of credential stuffing or brute force that succeeded, resulting in account takeover. The analyst should treat the privileged account as compromised.

Question 4Undetermined - official content domains not enumerated in the retrieved source

Which Cisco Umbrella capability helps block access to malicious domains before a connection is established?

  1. DNS-layer security Correct answer.
  2. Full packet capture
  3. Endpoint isolation
  4. Intrusion prevention

Explanation

Umbrella enforces security at the DNS layer, resolving and blocking requests to malicious or unwanted domains before a TCP connection occurs. This stops command-and-control and phishing callbacks early.

Question 5Undetermined - official content domains not enumerated in the retrieved source

What is the primary purpose of preserving volatile evidence such as memory during incident response?

  1. To capture data that is lost when the system is powered off Correct answer.
  2. To reduce storage requirements for the case
  3. To speed up the eradication phase
  4. To satisfy licensing requirements

Explanation

Volatile evidence like RAM contents, running processes, and network connections disappears on reboot or shutdown. Collecting it first preserves forensic artifacts needed for root-cause analysis.

Question 6Undetermined - official content domains not enumerated in the retrieved source

Which protocol and port does NetFlow traditionally use to export flow records to a collector?

  1. UDP 53
  2. UDP 2055 Correct answer.
  3. TCP 443
  4. TCP 22

Explanation

NetFlow exports flow records to a collector, commonly over UDP port 2055, though other ports can be configured. Analysts must know the export path to validate telemetry in flow-based investigations.

Question 7Undetermined - official content domains not enumerated in the retrieved source

What does a Cisco Secure Firewall intrusion event with action 'dropped' indicate?

  1. The sensor was offline
  2. The signature was disabled
  3. The malicious packet was blocked inline Correct answer.
  4. The packet was allowed and logged only

Explanation

A dropped action means the IPS was deployed inline and blocked the offending packet before delivery. This confirms prevention rather than detection-only logging.

Question 8Undetermined - official content domains not enumerated in the retrieved source

Which artifact is most useful for identifying persistence established by malware on a Windows host?

  1. Browser cookies
  2. Scheduled tasks and Run registry keys Correct answer.
  3. ARP table
  4. DNS cache entries

Explanation

Malware commonly persists through scheduled tasks, Run registry keys, and services. Reviewing these locations reveals how the threat survives reboots.

Question 9Undetermined - official content domains not enumerated in the retrieved source

A SOC analyst receives an alert for outbound traffic to a known command-and-control IP. Which initial containment action best limits further compromise while preserving evidence?

  1. Delete the suspicious files
  2. Shut down the host without collection
  3. Isolate the host from the network using endpoint or firewall controls Correct answer.
  4. Immediately reimage the host

Explanation

Network isolation cuts the attacker's channel while keeping the host running so memory and live artifacts can still be collected. Reimaging or powering off destroys volatile evidence and can tip off the attacker.

Question 10Undetermined - official content domains not enumerated in the retrieved source

Which Cisco technology can enforce network access policy based on endpoint posture during an incident?

  1. Cisco Identity Services Engine Correct answer.
  2. Cisco Umbrella
  3. Cisco Talos
  4. Cisco Secure Network Analytics

Explanation

Cisco ISE evaluates endpoint posture and identity to grant, restrict, or quarantine network access. During an incident, ISE can move a compromised endpoint into a remediation VLAN.

Question 11Undetermined - official content domains not enumerated in the retrieved source

An analyst needs to determine whether a suspicious binary executed on an endpoint. Which Windows artifact is most directly relevant?

  1. Prefetch files Correct answer.
  2. DHCP lease log
  3. Hosts file
  4. Routing table

Explanation

Windows Prefetch records execution of programs and stores timestamps and referenced files, making it valuable for proving execution. Other listed artifacts do not record process execution.

Question 12Undetermined - official content domains not enumerated in the retrieved source

Which Splunk search best finds DNS queries to a specific suspicious domain in proxy or DNS logs?

  1. index=dns | lookup threatintel
  2. index=dns stats count by user
  3. index=dns query="malicious.example.com" Correct answer.
  4. index=dns | delete malicious.example.com

Explanation

Filtering on the query field with the exact domain returns matching DNS events efficiently. This is the standard starting point for scoping which hosts contacted a domain.

Question 13Undetermined - official content domains not enumerated in the retrieved source

During analysis, an analyst finds beaconing traffic at regular intervals with jitter to an external host. What does this most likely indicate?

  1. Malware command-and-control communication Correct answer.
  2. A backup job
  3. A software update check
  4. Normal NTP synchronization

Explanation

Periodic, jittered connections to an external host are characteristic of command-and-control beaconing designed to evade simple interval detection. Legitimate services rarely use randomized jitter patterns.

Question 14Undetermined - official content domains not enumerated in the retrieved source

Which action should be taken first when a suspected ransomware infection is confirmed on a file server?

  1. Restore from backup immediately
  2. Run antivirus scans on all hosts simultaneously
  3. Disconnect the server from the network to stop lateral encryption Correct answer.
  4. Notify the media

Explanation

Containment must precede recovery; disconnecting the server prevents the ransomware from spreading to mapped shares and other hosts. Restoration should happen only after the threat is contained and eradicated.

Question 15Undetermined - official content domains not enumerated in the retrieved source

What is the role of Cisco Talos in a Cisco incident response engagement?

  1. Providing cloud storage
  2. Handling HR investigations
  3. Providing threat intelligence and signature research Correct answer.
  4. Managing firewall rule deployments

Explanation

Cisco Talos is the threat intelligence and research organization behind many Cisco security products, providing signatures and intelligence used in investigations. It does not perform HR or storage functions.

Question 16Undetermined - official content domains not enumerated in the retrieved source

An analyst observes a spike in SMB traffic from a workstation to many internal hosts. Which hypothesis should be investigated first?

  1. DNS tunneling
  2. Data exfiltration over HTTPS
  3. Phishing email delivery
  4. Lateral movement using stolen credentials Correct answer.

Explanation

A single host initiating SMB connections to many peers is consistent with lateral movement tools spreading across the network. Analysts should check authentication logs and remote service creation.

Question 17Undetermined - official content domains not enumerated in the retrieved source

Which method best verifies the integrity of collected forensic evidence during an investigation?

  1. Computing and recording cryptographic hashes Correct answer.
  2. Renaming the files with timestamps
  3. Compressing the files
  4. Encrypting the files with a shared password

Explanation

Hashing evidence at collection and re-hashing later demonstrates that it has not been altered, supporting chain of custody. Compression, renaming, or encryption do not provide integrity proof on their own.

Question 18Undetermined - official content domains not enumerated in the retrieved source

Which Cisco product provides secure web gateway and DNS protection for roaming users through a single agent?

  1. Cisco Secure Network Analytics
  2. Cisco Identity Services Engine
  3. Cisco Umbrella Correct answer.
  4. Cisco Secure Firewall Management Center

Explanation

Umbrella combines DNS-layer security, secure web gateway, and firewall capabilities delivered through a lightweight roaming client. It protects users on and off the corporate network.

Question 19Undetermined - official content domains not enumerated in the retrieved source

An analyst finds a process making HTTPS requests to a newly registered domain with a self-signed certificate. Which combination of indicators is most suspicious?

  1. New domain plus valid certificate plus signed process
  2. New domain plus self-signed certificate plus unusual process Correct answer.
  3. Established domain plus pinned certificate plus signed process
  4. Established domain plus valid certificate plus signed process

Explanation

Newly registered domains, self-signed certificates, and unusual processes together form a strong malicious pattern. Any single indicator can be benign, but the combination raises confidence.

Question 20Undetermined - official content domains not enumerated in the retrieved source

Which data source is most appropriate for detecting data exfiltration over DNS?

  1. Windows event logs
  2. DHCP lease logs
  3. DNS query logs with entropy and volume analysis Correct answer.
  4. Firewall interface counters

Explanation

DNS tunneling exfiltration shows high-entropy, long subdomain queries and unusual volume in DNS logs. Firewall counters, DHCP logs, and Windows event logs do not capture query content.

Question 21Undetermined - official content domains not enumerated in the retrieved source

An analyst must reconstruct the timeline of an incident. Which approach provides the most reliable ordering of events?

  1. Normalize timestamps to UTC across all sources Correct answer.
  2. Use local time from each device
  3. Order events by severity
  4. Use only the SIEM's ingestion time

Explanation

Normalizing timestamps to a single time zone, typically UTC, avoids misordering caused by device-local clocks and offsets. Ingestion time reflects when the SIEM received data, not when the event occurred.

Question 22Undetermined - official content domains not enumerated in the retrieved source

A compromised host is beaconing to an IP address that resolves from a domain generated by a domain generation algorithm. Which detection strategy is most effective?

  1. Block all outbound HTTPS
  2. Analyze DNS for high volumes of nonexistent-domain responses Correct answer.
  3. Disable DNS logging
  4. Allow all DNS traffic

Explanation

DGA activity produces many failed resolutions of algorithmically generated domains, so NXDOMAIN spikes are a strong detection signal. Blocking all HTTPS or disabling logging would harm operations and visibility.

Question 23Undetermined - official content domains not enumerated in the retrieved source

During a forensic review, an analyst finds that a user account was created and added to a privileged group outside change windows. Which conclusion is best supported?

  1. Possible persistence through unauthorized privilege escalation Correct answer.
  2. Routine administrative activity
  3. A hardware failure
  4. A benign software update

Explanation

Out-of-band creation of privileged accounts is a common persistence technique that gives attackers durable access. It should be investigated as possible privilege escalation and unauthorized access.

Question 24Undetermined - official content domains not enumerated in the retrieved source

An analyst wants to determine the scope of a credential-theft incident involving a compromised endpoint. Which evidence set is most relevant?

  1. Firewall throughput graphs
  2. Printer job logs
  3. Authentication logs across all systems for the compromised account Correct answer.
  4. Switch port statistics

Explanation

Scoping credential theft requires reviewing authentication logs across systems to find where the stolen credentials were used. Network performance data and printer logs do not reveal credential misuse.

Question 25Undetermined - official content domains not enumerated in the retrieved source

A host shows a persistent outbound connection to a rare external IP with periodic keepalives and no matching business application. Which combination of response actions is most appropriate?

  1. Disable logging to reduce noise
  2. Delete the connection entry and continue monitoring
  3. Reboot the host and ignore the connection
  4. Collect volatile data, isolate the host, and block the destination Correct answer.

Explanation

Suspected C2 requires preserving volatile evidence before containment, then isolating the host and blocking the destination to stop further communication. Rebooting or ignoring the connection destroys evidence and leaves the channel open.

Question 26Undetermined - official content domains not enumerated in the retrieved source

In a Cisco incident response workflow, which NIST SP 800-61 phase immediately follows detection and analysis?

  1. Preparation
  2. Containment, eradication, and recovery Correct answer.
  3. Post-incident activity
  4. Lessons learned review

Explanation

NIST SP 800-61 orders the incident response lifecycle as preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. Containment limits spread before eradication removes the threat and recovery restores normal operations.

Question 27Undetermined - official content domains not enumerated in the retrieved source

Which Cisco Secure Firewall feature generates intrusion events by comparing traffic against signatures?

  1. Site-to-site VPN policy
  2. Access control policy with intrusion prevention Correct answer.
  3. Quality of service policy
  4. Network address translation policy

Explanation

An access control policy invokes intrusion prevention inspection, which compares traffic to Snort signatures and raises intrusion events. NAT, QoS, and VPN policies handle translation, prioritization, and tunneling rather than signature detection.

Question 28Undetermined - official content domains not enumerated in the retrieved source

Which Cisco product family centralizes endpoint detection and response telemetry, such as process trees and file events, for investigation?

  1. Cisco Identity Services Engine
  2. Cisco Umbrella
  3. Cisco Secure Endpoint Correct answer.
  4. Cisco Secure Network Analytics

Explanation

Cisco Secure Endpoint is the endpoint agent that records process, file, and network telemetry and supports response actions on hosts. The other products provide network flow analytics, DNS/web security, and identity policy enforcement respectively.

Question 29Undetermined - official content domains not enumerated in the retrieved source

An analyst needs the standard hash used to verify that a collected disk image has not changed since acquisition. Which value should the analyst compute and record at acquisition time?

  1. SHA-256 of the entire image Correct answer.
  2. MD5 of the file system journal only
  3. CRC32 of the partition table
  4. Base64 encoding of the image header

Explanation

A cryptographic hash of the complete image, computed at acquisition and re-verified later, demonstrates integrity; SHA-256 is the current standard. Hashing only part of the image or using a non-cryptographic checksum cannot prove the whole image is unchanged.

Question 30Undetermined - official content domains not enumerated in the retrieved source

Which Cisco capability lets an analyst isolate a compromised endpoint from the network while preserving the agent connection for investigation?

  1. Cisco ISE posture reassessment
  2. Cisco Secure Endpoint host isolation Correct answer.
  3. Cisco Secure Firewall captive portal
  4. Cisco Umbrella block page

Explanation

Host isolation in Secure Endpoint cuts the endpoint off from most network traffic while keeping the management channel so analysts can continue collecting data and take further action. The other options either block web destinations, gate guest access, or recheck posture without isolating the host.

Question 31Undetermined - official content domains not enumerated in the retrieved source

Which Cisco Secure Firewall event field indicates the action the device took on a connection that matched an access control rule?

  1. The connection's action, such as Allow or Block Correct answer.
  2. The device's serial number
  3. The policy's default intrusion variable set
  4. The rule's revision number

Explanation

Connection events record the action taken, such as Allow, Block, or Trust, which tells the analyst whether traffic was permitted. Revision numbers, serial numbers, and variable sets describe configuration, not the disposition of a specific connection.

Question 32Undetermined - official content domains not enumerated in the retrieved source

Which log source most directly records the creation of a new scheduled task on a Windows endpoint?

  1. Firewall connection events
  2. NetFlow records
  3. Windows Security event logs for process creation and task scheduler operational logs Correct answer.
  4. DNS server query logs

Explanation

Task creation is captured in the Task Scheduler operational log and often accompanied by process creation events showing schtasks.exe. Network-focused sources such as DNS, firewall, and NetFlow logs do not record local scheduled task registration.

Question 33Undetermined - official content domains not enumerated in the retrieved source

During triage, an analyst wants to confirm whether a suspicious domain was resolved by corporate endpoints. Which Cisco data source provides this visibility?

  1. Cisco Secure Endpoint policy audit logs
  2. Cisco Umbrella DNS activity logs Correct answer.
  3. Cisco ISE accounting logs
  4. Cisco Secure Firewall NAT translations

Explanation

Umbrella resolves DNS for protected clients and logs each query with identity, making it the direct source for confirming domain resolution. NAT, accounting, and policy audit logs do not record DNS queries by name.

Question 34Undetermined - official content domains not enumerated in the retrieved source

An analyst is building a timeline and finds that a firewall event and an endpoint event disagree by several minutes. Which factor should be checked first before concluding the events are unrelated?

  1. The endpoint's installed memory
  2. The collector's disk capacity
  3. Clock synchronization and time zone normalization across sources Correct answer.
  4. The firewall's licensed throughput

Explanation

Log sources frequently record timestamps in different time zones or with unsynchronized clocks, which can make causally related events appear out of order. Normalizing to a common time zone and verifying NTP synchronization is the first step before drawing conclusions.

Question 35Undetermined - official content domains not enumerated in the retrieved source

An analyst observes a workstation resolving hundreds of unique, random-looking domains in a short period, most returning NXDOMAIN. Which hypothesis best fits this pattern?

  1. The host is experiencing a DNS server failover
  2. The host is resolving domains from a cached browser history
  3. The host is infected with malware using a domain generation algorithm Correct answer.
  4. The host is performing a legitimate software update

Explanation

High-volume queries to algorithmically random domains with many NXDOMAIN responses are characteristic of DGA-based malware searching for its active command-and-control domain. Software updates, failover, and cache reads produce predictable, repeatable name patterns.

Question 36Undetermined - official content domains not enumerated in the retrieved source

A SOC receives an alert that a server initiated an outbound connection to an external host on TCP 4444, a port uncommon for the server's role. Which investigative step best confirms whether this is malicious?

  1. Correlate the connection with the responsible process and its parent on the endpoint Correct answer.
  2. Verify the switch port speed
  3. Review the server's patch level
  4. Check the firewall's uptime

Explanation

Identifying the process behind the connection and its parent reveals whether a legitimate service or an attacker tool opened it. Uptime, patch level, and link speed are host or network health facts that do not explain the connection's origin.

Question 37Undetermined - official content domains not enumerated in the retrieved source

Which evidence best establishes that a user account was used to authenticate to a remote system during an incident?

  1. DNS cache entries on the target
  2. Firewall throughput counters
  3. Windows Security logon events with logon type and source workstation Correct answer.
  4. Local file creation timestamps on the target

Explanation

Security logon events record the account, logon type, and source workstation, directly evidencing remote authentication. File timestamps, throughput counters, and DNS cache do not attribute an authentication to an account.

Question 38Undetermined - official content domains not enumerated in the retrieved source

An analyst must preserve volatile data on a running Linux server suspected of compromise. Which collection order best follows the order of volatility?

  1. Printed documentation first, then disk contents
  2. Memory and running processes first, then disk contents Correct answer.
  3. Disk contents first, then memory and processes
  4. Network diagrams first, then memory

Explanation

The order of volatility directs analysts to capture the most perishable data, such as memory and running process state, before more persistent disk data. Capturing disk first risks losing memory-resident evidence as the system changes or reboots.

Question 39Undetermined - official content domains not enumerated in the retrieved source

Which Cisco Secure Firewall event type would an analyst review to see files detected and malware verdicts for traffic traversing the device?

  1. File and malware events Correct answer.
  2. Connection events
  3. Intrusion events
  4. Health events

Explanation

File and malware events record file transfers inspected by the device along with malware verdicts and dispositions. Intrusion events record signature matches, connection events record traffic disposition, and health events report device status.

Question 40Undetermined - official content domains not enumerated in the retrieved source

An analyst finds a scheduled task that runs an encoded PowerShell command at startup on multiple hosts. Which eradication step best addresses the root cause?

  1. Reset the users' passwords without further host action
  2. Block the external IP at the perimeter only
  3. Remove the task and the referenced payload, then verify no persistence remains Correct answer.
  4. Reboot the hosts and monitor for new alerts

Explanation

Eradication removes the attacker's foothold, so the malicious task and payload must be deleted and persistence rechecked across affected hosts. Rebooting, perimeter blocking, or password resets alone leave the persistence mechanism intact.

Question 41Undetermined - official content domains not enumerated in the retrieved source

An analyst is correlating proxy logs, DNS logs, and endpoint events from different vendors. Which practice most improves confidence in the combined timeline?

  1. Convert all events to the local analyst time zone only
  2. Rely on the source with the largest log volume
  3. Normalize timestamps to UTC and map fields to a common schema before correlation Correct answer.
  4. Delete records that lack a matching peer event

Explanation

Normalizing time to a single zone such as UTC and mapping fields to a common schema lets events from diverse sources be compared meaningfully. Discarding unmatched records, favoring volume, or using a local zone introduces bias or ordering errors.

Question 42Undetermined - official content domains not enumerated in the retrieved source

Which artifact most directly shows that a program established autostart behavior through the Windows registry?

  1. Prefetch file timestamps
  2. DNS client cache
  3. Run key entries under the user or machine hive Correct answer.
  4. Windows update history

Explanation

Run and RunOnce keys are common registry autostart locations, so their entries directly evidence persistence. Prefetch shows execution history, DNS cache shows resolution, and update history shows patching, none of which prove autostart configuration.

Question 43Undetermined - official content domains not enumerated in the retrieved source

An analyst must determine which internal hosts communicated with a suspicious external IP over the past week. Which data source is best suited for this scope question?

  1. Switch configuration backups
  2. NetFlow or firewall connection records filtered by the external address Correct answer.
  3. Endpoint antivirus definition version reports
  4. Active Directory group membership exports

Explanation

Flow and connection records capture which internal addresses talked to a given external address over time, directly answering scope. Definition versions, group membership, and switch configurations contain no conversation data.

Question 44Undetermined - official content domains not enumerated in the retrieved source

An analyst observes a host making small, regular DNS queries with long random subdomains to a single authoritative server. Which conclusion is most consistent with this behavior?

  1. Normal web browsing through a proxy
  2. Routine operating system time synchronization
  3. A misconfigured DHCP server
  4. Possible DNS tunneling used for command-and-control or exfiltration Correct answer.

Explanation

Long random subdomains sent steadily to one authoritative server suggest data encoded in DNS queries, a hallmark of tunneling. Browsing, DHCP faults, and time sync do not produce that query pattern.

Question 45Undetermined - official content domains not enumerated in the retrieved source

A confirmed compromise affects several servers in one subnet. Which containment approach best limits lateral movement while preserving evidence?

  1. Disable logging to reduce noise during cleanup
  2. Immediately reimage all servers without collecting data
  3. Segment or isolate the affected subnet and preserve logs and memory before remediation Correct answer.
  4. Shut down the entire corporate network indefinitely

Explanation

Segmenting the affected subnet contains spread while evidence is captured, supporting later analysis and recovery. Reimaging without collection, shutting everything down, or disabling logging destroys evidence and disrupts operations unnecessarily.

Question 46Undetermined - official content domains not enumerated in the retrieved source

An analyst finds a suspicious binary on a host but no corresponding execution artifact in Prefetch or event logs. Which explanation is most plausible?

  1. The binary is a signed Microsoft driver
  2. The binary was placed but not executed, or execution artifacts were cleared Correct answer.
  3. The host has no operating system
  4. The binary was executed and Prefetch always records every run

Explanation

Absence of execution artifacts suggests the file may be staged but not run, or that logs and Prefetch were deleted by an attacker. Prefetch does not record every execution, and signing status does not explain missing artifacts.

Question 47Undetermined - official content domains not enumerated in the retrieved source

During an investigation, an analyst notes that a firewall shows an allowed connection while the endpoint shows no matching process. Which explanation should be investigated first?

  1. The endpoint's clock is always correct
  2. The firewall must be malfunctioning and should be replaced
  3. The endpoint telemetry may be incomplete or the traffic originated from another host behind NAT Correct answer.
  4. The connection was definitely benign

Explanation

Missing endpoint evidence can result from gaps in telemetry or from address translation hiding the true source host. Assuming device failure, trusting clocks blindly, or declaring the traffic benign skips necessary verification.

Question 48Undetermined - official content domains not enumerated in the retrieved source

An analyst must decide whether an alert represents a true positive before escalating. Which approach best supports that decision?

  1. Validate the alert against corroborating endpoint, identity, and network evidence Correct answer.
  2. Escalate every alert without review to avoid misses
  3. Rely solely on the alert's severity score
  4. Close the alert because the signature is new

Explanation

Confirming an alert with independent evidence from multiple sources distinguishes true positives from benign triggers. Escalating blindly, dismissing new signatures, or trusting severity alone leads to errors in both directions.

Question 49Undetermined - official content domains not enumerated in the retrieved source

An analyst discovers that an attacker used valid credentials rather than malware. Which evidence combination best supports this conclusion?

  1. A spike in outbound bandwidth from a server
  2. Multiple malware detections on the same host
  3. New local administrator accounts created by a script
  4. Successful authentications from unusual locations with no malicious process activity Correct answer.

Explanation

Valid-account abuse shows successful logons from anomalous sources without the process or file artifacts of malware. Malware detections, bandwidth spikes, and scripted account creation point to other intrusion methods or effects.

Question 50Undetermined - official content domains not enumerated in the retrieved source

An analyst needs to determine whether data left the network during an incident. Which evidence set best supports that determination?

  1. Inbound port scan records from the internet
  2. Switch spanning-tree topology changes
  3. Outbound flow volume anomalies correlated with sessions to external hosts and proxy upload records Correct answer.
  4. Local user login failures on a workstation

Explanation

Exfiltration is evidenced by unusual outbound volume tied to external sessions and confirmed by proxy upload logs showing content leaving. Inbound scans, login failures, and topology changes do not demonstrate data leaving the network.