300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CybersecurityDemo

By Cisco · Question Mode

QuestionQ73

Incident Response Techniques

A security team receives a notification from a Cisco ESA solution that an employee was sent an advertising email containing an attachment with a .pdf extension. The employee opened the attachment, which seemed to be a blank document. The security analyst finds no clear indicators of compromise, but examines running processes and finds that PowerShell.exe was spawned by CMD.exe, whose grandparent process was AcroRd32.exe. Which two actions should be taken to resolve this issue?

Choose two
  • A Upload the .pdf file to Cisco Threat Grid and analyze suspicious activity in depth.
  • B No action is required because this behavior is standard for .pdf files.
  • C Check the Windows Event Viewer for security logs about the incident.
  • D Quarantine this workstation for further investigation, as this event is an indication of suspicious activity.
  • E Investigate the reputation of the sender address and temporarily block all communications with this email domain.
Explanation

A PDF reader launching CMD.exe and subsequently PowerShell.exe is suspicious process behavior that can indicate malicious code execution from a crafted attachment. Isolating the workstation contains a possible compromise while it is investigated. Cisco Secure Malware Analytics (formerly Threat Grid) performs sandboxed behavioral analysis of submitted files and returns a threat score and detailed analysis, making it appropriate for evaluating the suspicious PDF.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!