300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity

By Cisco · Question Mode

QuestionQ10

Forensics Techniques

Question Image

Refer to the exhibit. A network engineer is reviewing a Wireshark capture to identify the HTTP request that triggered download of the initial Ursnif banking Trojan binary. Which filter did the engineer use to sort the Wireshark traffic logs?

Explanation

An HTTP request URI matching filter isolates HTTP GET requests by their requested resource path, allowing the malicious download request to be identified. TLS ClientHello, TCP port 25, and zero TCP-window filters do not target HTTP download URIs.

Community Discussion

No comments yet. Be the first to start the discussion!