MENU
Refer to the exhibit.
According to the Wireshark output, what are two indicators of compromise for detecting an Emotet malware download? (Choose two.)
Suggested Answer: D
Get Premium 300-215 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
35 comments · newest first
AR
Art
11 months ago
Hash values can be misleading, not always a solid indicator.
KE
Kenda
11 months ago
E is a big red flag too, application/octet-stream is suspicious.
JA
Jacqueline
11 months ago
Surprised to see A, I thought that domain was clean!
JE
Jesus
11 months ago
I think B is a red herring, nginx is pretty common.
VI
Vicky
12 months ago
Definitely A and D, those are classic signs of Emotet.
AH
Ahmed
12 months ago
I think the Content-Type being application/octet-stream is a common sign of malware downloads, but I’m not 100% certain about the other options.
CA
Carlton
1 year ago
I’m a bit confused about the hash value. I don’t recall if that’s a strong indicator for Emotet specifically, but it seems relevant.
SH
Shayne
1 year ago
I'm not entirely sure, but I feel like the filename 'Fy.exe' might also be suspicious based on similar practice questions we did.
CH
Charlene
1 year ago
I remember we discussed Emotet in class, and I think the domain name could definitely be a key indicator.
KR
Kristeen
1 year ago
This is a tricky one, but I think I've got it. The domain name and content type are clear indicators of an Emotet attack. I'll select those two options and move on.
BL
Blair
1 year ago
I'm a bit confused by all the technical details in this question. I'll try to identify the most obvious signs of compromise, like the suspicious domain name and file type.
MA
Matilda
1 year ago
Hmm, the domain name and server info seem like they could be relevant, but I'm not sure what to make of the hash value and filename. I'll have to think this through carefully.
LU
Luisa
1 year ago
This looks like a classic Emotet malware detection question. I'll focus on finding the indicators of compromise in the Wireshark output.
CA
Carolann
1 year ago
Okay, I see the domain name "iraniansk.com" and the "application/octet-stream" content type - those are definitely indicators of an Emotet download. I'll select those two.
SU
Sue
1 year ago
I'm just glad I don't have to deal with this stuff in real life. I'll stick to my spreadsheets and PowerPoint presentations, thank you very much.
MA
Malcolm
1 year ago
User 3: Those indicators of compromise can be tricky to detect.
AN
Andra
1 year ago
User 2: Definitely. I prefer working with spreadsheets too.
CO
Cortney
1 year ago
User 1: Yeah, dealing with malware is a whole different world.
JO
Jordan
1 year ago
Haha, 'Fy.exe'? Really? They couldn't come up with a more creative file name? And the domain 'iraniansk.com' - sounds like it was registered by a toddler.
NA
Nana
1 year ago
User 3: Nana: And 'iraniansk.com' sounds suspicious too.
LA
Laine
1 year ago
User 2: Laine: Yeah, they could have been a bit more creative with that.
SU
Sunshine
1 year ago
User 1: I know right, 'Fy.exe' is such a generic name.
DO
Dottie
2 years ago
The nginx server and the content type 'application/octet-stream' are also good signs that something fishy is going on. I bet the hash value is just there to confuse us.
KA
Kasandra
1 year ago
I agree, the hash value might just be a distraction from the real indicators of compromise.
LE
Leah
1 year ago
Yeah, the filename 'Fy.exe' is also a red flag for sure.
NA
Nancey
1 year ago
I think we should also keep an eye on the domain name 'iraniansk.com'.
CE
Cecil
1 year ago
I agree, the nginx server and content type are definitely suspicious.
AR
Art
2 years ago
I'm not sure about the hash value, but I think the filename and content type could also be indicators of compromise.
PE
Pearly
2 years ago
I agree with you, Johnathon. The domain name and hash value seem like key indicators in this case.
CA
Casey
2 years ago
The domain name 'iraniansk.com' and the file name 'Fy.exe' are definitely indicators of compromise for Emotet malware. This is really helpful information to detect and prevent such attacks.
SK
Skye
1 year ago
Emotet malware is a serious threat, so it's good to know what to watch for.
RO
Rosamond
1 year ago
I will make sure to keep an eye out for those indicators in our network traffic.
CE
Celia
1 year ago
It's important to stay vigilant and monitor for any signs of compromise.
FA
Fausto
1 year ago
I agree, those are definitely key indicators to look out for.
JO
Johnathon
2 years ago
I think the indicators of compromise for detecting Emotet malware download are domain name and hash value.