Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Cisco 300-215 Exam - Topic 9 Question 40 Discussion

Refer to the exhibit.According to the Wireshark output, what are two indicators of compromise for detecting an Emotet malware download? (Choose two.)
C) Hash value: 5f31ab113af08=1597090577 and E) Content-Type: application/octet-stream
A) Domain name:iraniansk.com
B) Server: nginx
D) filename= ''Fy.exe''

Cisco 300-215 Exam - Topic 9 Question 40 Discussion

Actual exam question for Cisco's 300-215 exam
Question #: 40
Topic #: 9
[All 300-215 Questions]

Refer to the exhibit.

According to the Wireshark output, what are two indicators of compromise for detecting an Emotet malware download? (Choose two.)

Show Suggested Answer Hide Answer
Suggested Answer: C, E

by Barrett at May 27, 2022, 02:07 PM

Limited Time Offer

25%

Off

Get Premium 300-215 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Quentin
10 months ago
Wait, people still download stuff from unknown domains? Really?
upvoted 0 times
...
Delisa
10 months ago
Not sure about the nginx server being a problem.
upvoted 0 times
...
Loreta
10 months ago
Hash value 5f31ab113af08? Sounds like a red flag.
upvoted 0 times
...
Lorrie
11 months ago
I think Fy.exe is a clear indicator too.
upvoted 0 times
...
Kattie
11 months ago
Domain name iraniansk.com is definitely suspicious.
upvoted 0 times
...
Joanne
11 months ago
I think "E" is a strong candidate too, as application/octet-stream is a common content type for malicious files.
upvoted 0 times
...
Ashlyn
11 months ago
I'm not entirely sure, but I feel like "D" could be relevant since executable files are often associated with malware downloads.
upvoted 0 times
...
Glenn
11 months ago
I remember discussing how domain names can be a key indicator of malware, so I think "A" might be one of the answers.
upvoted 0 times
...
Patria
11 months ago
I practiced a similar question, and I feel like "C" could be a trick option since hash values are often used to identify malware, but I'm not completely confident.
upvoted 0 times
...
Casandra
11 months ago
Hmm, I'm not entirely sure about this one. I'll need to review my notes on Citrix SBC/HVD tuning to make sure I understand the best approach.
upvoted 0 times
...

Save Cancel