300-215 Exam Dumps : Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

The command in the image usesschtasks /createwith theONLOGONschedule andSystemuser context to executetest.exe. This is a well-documented persistence technique, where an attacker ensures that a malicious executable is launched automatically at each system logon. This kind of scheduled task creation aligns with persistence techniques in the MITRE ATT&CK framework (T1053).

—

The syntax in the code snippet includes:

On Error Resume Next– a classic VBScript error-handling directive.

function ... end functionstructure.

Use ofMid(),Chr(), andAsc()functions – all commonly used in VBScript for string manipulation.

CInt()for conversion – typical in VBScript.

These characteristics alignexactly with VBScript, which is frequently used in malicious macros and obfuscated payloads for malware distribution, as covered in the Cisco CyberOps Associate curriculum when analyzing scripts and encoded threats.

The metadata in the exhibit reveals a strong indicator that this .LNK file (shortcut) is malicious:

The shortcut file is named "ds7002.pdf" but actually points to the execution of PowerShell:→ Full path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Arguments include:→ -noni -ep bypass $z = '...'; indicating an attempt to run a PowerShell script with execution policy bypassed (a known tactic for fileless malware delivery).

The file is masked as a PDF (common social engineering technique), and PowerShell execution via .LNK is a signature technique used by many malware families to initiate second-stage payloads or scripts.

Given this, the correct and safest course of action is to:

→ Open the .LNK file in a sandbox environment (D).

This enables safe behavioral analysis to observe what actions it attempts upon execution without endangering live systems.

Other options are inappropriate:

A (ignoring the threat due to extension) is dangerous — .LNKs can trigger code.

B (upload to virus engine) is only helpful for known malware and lacks behavioral context.

C (quarantine) is preventive but not investigative — sandboxing provides visibility.