Discuss Cisco 300-215 Exam Topic 6 Question 118

A threat hunter must analyze the threat intelligence report on APT29 and identify whether the threat actor is on the Windows machines of the customer network. According to the report the user executes a malicious file on the victim machine that establishes a C? connection over port 53 Afterward, the attacker uses a CI.I to stage and exfiltrate business data. Which two types of logs enable the threat hunter to accomplish the task? (Choose two.)

Afile integrity monitoring logs

BPowerShell togs

Cweb application firewall logs

DNetFlow logs

EDNS logs

Suggested Answer: B, E

Get Premium 300-215 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

14 comments · newest first

Suzi 2 days ago

True, but DNS logs are more direct for this scenario.

Fernanda 8 days ago

What about NetFlow logs? They can show traffic patterns.

Haydee 13 days ago

I’d go with DNS logs too. They track domain requests.

Mickie 18 days ago

Agreed, DNS logs show the C2 connection over port 53.

Kimberely 23 days ago

This question is tricky! I think DNS logs are key here.

Clarinda 28 days ago

Wait, are we really sure APT29 is using port 53? That seems unusual!

Marvel 1 month ago

I agree, E) DNS logs are a must! But what about D) NetFlow logs?

Nelida 1 month ago

Not sure about B) PowerShell logs being relevant here. Seems a bit off.

Lisha 1 month ago

I think A) file integrity monitoring logs could also help identify the malicious file.

Adelina 2 months ago

Definitely going with E) DNS logs. That's key for tracking that C2 connection.

Simona 2 months ago

I feel like file integrity monitoring logs might not be the best choice here since the focus is on network activity rather than file changes.

Margart 2 months ago

I’m a bit confused about the PowerShell logs. I know they can show script execution, but would they really help in this scenario?

Nguyet 2 months ago

I remember practicing a similar question where we had to identify logs for network traffic analysis. NetFlow logs might be relevant too, right?

Evangelina 2 months ago

I think DNS logs could be crucial here since the connection is over port 53, but I'm not sure about the second log type.

Cisco 300-215 Exam - Topic 6 Question 118 Discussion