Discuss Cisco 300-215 Exam Topic 4 Question 103

During a routine inspection of system logs, a security analyst notices an entry where Microsoft Word initiated a PowerShell command with encoded arguments. Given that the user's role does not involve scripting or advanced document processing, which action should the analyst take to analyze this output for potential indicators of compromise?

AMonitor the Microsoft Word startup times to ensure they align with business hours.

BConfirm that the Microsoft Word license is valid and the application is updated to the latest version.

CValidate the frequency of PowerShell usage across all hosts to establish a baseline.

DReview the encoded PowerShell arguments to decode and determine the intent of the script.

Suggested Answer: D

According to the CyberOps Technologies (CBRFIR) 300-215 study guide curriculum, when analyzing suspicious behavior---especially when scripts or shell commands are executed from applications like Word (which is uncommon)---the encoded PowerShell payload must be decoded to determine if malicious intent is present. Deobfuscation is a critical step in identifying command-and-control behavior, persistence, or malware execution paths.

---

Get Premium 300-215 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

25 comments · newest first

Harris 10 months ago

I agree, reviewing the script intent is key here.

Carmen 10 months ago

Monitoring startup times? Seems a bit off.

Hershel 10 months ago

Definitely need to decode those PowerShell args!

Meghan 11 months ago

Sounds like a classic case of malware.

Ettie 11 months ago

Wait, Microsoft Word can run PowerShell? That's surprising!

Tresa 11 months ago

I feel like decoding the PowerShell arguments is crucial here. It could reveal what the script was trying to do, which is definitely a sign of compromise.

Vernell 11 months ago

I think we practiced a question similar to this where we had to analyze PowerShell usage. Validating that frequency could help, but it might not pinpoint the immediate issue.

Alonzo 11 months ago

I'm not entirely sure, but monitoring startup times seems a bit off for this situation. It doesn't really address the potential threat directly.

Roselle 12 months ago

I remember we discussed how encoded PowerShell commands can be a red flag, so I think reviewing those arguments might be the best option.

Desirae 12 months ago

I feel pretty confident about this one. Validating the PowerShell usage across the network will help establish a baseline and identify any anomalies.

Natalie 12 months ago

Option D is definitely the way to go. Reviewing the encoded PowerShell script is the key to identifying potential indicators of compromise in this scenario.

Jaclyn 1 year ago

I'm a bit confused by this question. Wouldn't monitoring the Word startup times or checking the license be more relevant for a routine inspection?

Cassi 1 year ago

Hmm, decoding the PowerShell arguments sounds like the best approach here. I'll make sure to thoroughly analyze the output and look for any suspicious activity.

Yoko 1 year ago

This seems like a tricky one. I'll need to think carefully about the options and consider the potential indicators of compromise.

Junita 1 year ago

I agree with Marguerita. Decoding the arguments can help us understand the intent of the script.

Brittney 1 year ago

Option D all the way. If I saw that in our logs, I'd be more worried than a cat in a room full of rocking chairs! Gotta nip that in the bud, pronto.

Marguerita 1 year ago

I think we should review the encoded PowerShell arguments to decode them.

Corinne 1 year ago

Option D is the way to go. I mean, who knows, maybe it's just the IT guy running a script to optimize Word or something. But better safe than sorry, right?

Octavio 1 year ago

I'd go with D as well. Encoded PowerShell? That's a huge red flag. Better get to the bottom of it before it becomes a bigger problem.

Mitzie 1 year ago

Definitely option D. We need to decode that PowerShell script and figure out what it's up to. Can't have any shady business going on in our system logs!

Shizue 1 year ago

↳ replying to Mitzie

User3: Decoding the PowerShell script will help us determine the intent behind it.

Jeffrey 1 year ago

↳ replying to Mitzie

User2: Yeah, we can't take any chances with suspicious activity in our system logs.

Gail 1 year ago

↳ replying to Mitzie

User2: Yeah, we can't take any chances with suspicious activity in our system logs.

Celia 1 year ago

↳ replying to Mitzie

User1: I agree, we should definitely decode that PowerShell script to see what it's doing.

Ronny 1 year ago

↳ replying to Mitzie

User1: I agree, we should definitely decode that PowerShell script to see what it's doing.

Cisco 300-215 Exam - Topic 4 Question 103 Discussion