300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CybersecurityDemo

Question

Question Image

Refer to the exhibit. A network engineer is reviewing a Wireshark capture to identify the HTTP request that triggered download of the initial Ursnif banking Trojan binary. Which filter did the engineer use to sort the Wireshark traffic logs?

A http.request.un matches
B tls.handshake.type ==1
C tcp.port eq 25
D tcp.window_size ==0

Explanation

An HTTP request URI matching filter isolates HTTP GET requests by their requested resource path, allowing the malicious download request to be identified. TLS ClientHello, TCP port 25, and zero TCP-window filters do not target HTTP download URIs.

300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CybersecurityDemo

AstroTutor

Notes

Readiness

QuestionQ10

Community Discussion