300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CybersecurityDemo

By Cisco · Question Mode

QuestionQ107

Forensics Techniques

Question Image

Refer to the exhibit. An alert reported potentially suspicious activity from a machine in the HR department. Which two IOCs should the security analyst flag?

Choose two
  • A powershell.exe used on HR machine
  • B сmd.exe executing from \Device\HarddiskVolume3\
  • C WScript.exe initiated by powershell.exe
  • D cmd.exe starting powershell.exe with Base64 conversion
  • E WScript.exe acting as a parent of cmd.exe
Explanation

A command shell launching PowerShell to decode and execute Base64-obfuscated content is a suspicious indicator because Base64 encoding can conceal the command payload. WScript.exe is the parent of cmd.exe in the observed process chain, indicating script-host-driven command execution; this parent-child relationship is also suspicious in combination with the obfuscated PowerShell activity. PowerShell and cmd.exe are legitimate Windows utilities, so their presence alone or cmd.exe running from its standard System32 location is not sufficient evidence.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!