300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CybersecurityDemo

By Cisco · Question Mode

QuestionQ78

Forensics Techniques

During a routine review of system logs, a security analyst finds an entry showing Microsoft Word launching a PowerShell command with encoded arguments. Because the user’s role does not require scripting or advanced document processing, which action should the analyst take to examine this output for possible indicators of compromise?

  • A Monitor the Microsoft Word startup times to ensure they align with business hours.
  • B Confirm that the Microsoft Word license is valid and the application is updated to the latest version.
  • C Validate the frequency of PowerShell usage across all hosts to establish a baseline.
  • D Review the encoded PowerShell arguments to decode and determine the intent of the script.
Explanation

Encoded PowerShell arguments can conceal the command’s true actions. Decoding and reviewing them reveals the script’s intent and helps identify malicious behavior or other indicators of compromise.

Community Discussion

No comments yet. Be the first to start the discussion!