Free 300-215 sample questions

Correct answer: Deploy a virtual patch on the Cisco Secure Firewall's IPS module to specifically block the SQL injection signature.

Deploying a virtual patch on the IPS is the best immediate action. This technique uses the IPS to inspect traffic and block the specific malicious pattern (the SQL injection attempt) before it reaches the vulnerable server. This mitigates the risk without taking the server offline (which causes business impact) or only blocking a single source IP (which the attacker can easily change). Shutting down the database is a last resort and highly disruptive.

Correct answers: Modify the AWS Security Group to restrict inbound RDP access (port 3389) to only trusted source IP ranges, such as the corporate office or a VPN gateway.; Implement a more secure access method, such as using AWS Systems Manager Session Manager or a bastion host, and disable direct RDP access from the internet.

The most effective way to stop a brute-force attack against a cloud instance is to restrict network access. Modifying the Security Group to allow RDP traffic only from known, trusted IP addresses immediately cuts off the attackers. Additionally, for administrative access, using a bastion host or AWS Systems Manager provides a more secure, audited, and controlled access method than exposing RDP directly to the internet.

The most effective way to stop a brute-force attack against a cloud instance is to restrict network access. Modifying the Security Group to allow RDP traffic only from known, trusted IP addresses immediately cuts off the attackers. Additionally, for administrative access, using a bastion host or AWS Systems Manager provides a more secure, audited, and controlled access method than exposing RDP directly to the internet.

Correct answer: Execute a playbook that uses the Cisco Secure Endpoint API to isolate the host from the network.

The most critical and immediate action for a confirmed high-fidelity alert on a critical server is containment. Using a SOAR playbook to trigger Cisco Secure Endpoint's host isolation feature is the fastest and most effective way to prevent lateral movement or further malicious activity from the compromised host. While blocking the IP is a good step, it doesn't stop the malware on the host from attempting to communicate with other internal systems. A vulnerability scan is too slow and does not address the active threat.

Correct answer: The EC2 instance has been compromised and is connecting to an IRC-based Command and Control (C2) server.

Cisco Secure Cloud Analytics excels at behavioral analysis and anomaly detection. The alert indicates a deviation from the instance's normal traffic baseline. TCP port 6667 is the standard port for Internet Relay Chat (IRC), a protocol historically and currently used by malware for command and control (C2) communications. A long-lived connection on this non-standard port from a web server is a very strong indicator of compromise.

Correct answers: Modify the AWS Security Group for the instance to deny all outbound traffic on TCP port 3389.; Isolate the EC2 instance for forensic analysis and, once analyzed, terminate it and redeploy from a known-good Amazon Machine Image (AMI).

This is a direct and immediate containment action. The observed behavior indicates the instance may be compromised and used for scanning or brute-forcing other RDP servers. Blocking outbound RDP (TCP/3389) at the network layer via the Security Group will immediately stop the malicious activity.

This follows the principles of incident response: contain, eradicate, and recover. Isolating the instance (e.g., by moving it to a quarantined security group with no ingress/egress) preserves it for forensic analysis to determine the root cause. The long-term solution is to terminate the compromised instance and redeploy a clean one, ensuring the vulnerability that led to the compromise is fixed in the new AMI.

Correct answer: hollowfind

The `hollowfind` plugin is specifically designed to detect process hollowing techniques. It scans for discrepancies between a process's in-memory data structures (like the PEB) and its corresponding on-disk file, which is the hallmark of this attack.

Correct answer: Command and Control (C2) Beaconing

The pattern of numerous small, outbound connections to various IPs on non-standard ports is a classic indicator of C2 beaconing or scanning for a live C2 server. Cisco Secure Network Analytics excels at detecting such behavioral anomalies against a learned baseline of normal traffic.

Correct answers: A `strings` section defining byte patterns of the XOR decoding logic itself.; A `condition` section that requires multiple, distinct indicators to be present.

The decoding routine is often a stable piece of code across malware variants. Creating a signature based on the immutable byte patterns of this logic provides a highly resilient detection mechanism.

A strong condition, such as `(uint32(0) == 0x5A4D) and (2 of ($group1)) and (all of ($group2))`, ensures that multiple pieces of evidence must be found. This significantly reduces false positives and makes the rule more reliable and resilient against simple changes.

Correct answer: Use Cisco Secure Endpoint to isolate the host from the network.

Isolating the host is the most effective immediate containment step. It instantly severs the endpoint's network connections (except to the management console), preventing lateral movement, C2 communication, and further damage while allowing the response team to investigate the isolated machine.

Correct answer: True

The statement is true. The connection table on a Cisco ASA, displayed by `show conn`, contains the state of active network connections. This information is stored in RAM and is highly volatile. It will be lost upon reboot, power loss, or if the connections time out. It is a critical piece of evidence that must be collected early in an investigation.