Changed 300-215 Exam Questions

YARA rules are pattern-matching rules used to identify malware based on specific strings, conditions, and binary patterns. They are most effective in memory or file scans where analysts search for known indicators or unique signatures via string matching.

Correct answer: C. string matching.

The-hoption in theobjdumpcommand displayssection headersof an object file. According to general usage and command-line documentation, and also explained in digital forensics tools discussions in the CyberOps course, the header information includes details about the name, size, VMA, LMA, file offset, and alignment of each section in the object file. This helps analysts understand how data is stored and organized within compiled files during forensic examinations.

Comprehensive and Detailed Explanation:

The log entries show repeated SSH login attempts for various invalid usernames (e.g., admin, phoenix, rainbow, test, user, etc.) from different source ports. These are clear signs of a brute-force attack—an automated process trying multiple usernames and passwords in hopes of gaining access.

Mitigating such attacks includes:

Implementing account lockout policies (e.g., locking an account after several failed login attempts).

Enabling Multi-Factor Authentication (MFA) to ensure that password guessing alone is insufficient for account access.

Therefore, the correct answer is:

D. Brute-force attack; implement account lockout policies and roll out MFA.

The exhibit shows a PowerShell script that modifies registry keys under:

HKCU:\Software\Classes\Folder\shell\open\command

This technique is commonly associated with aUAC (User Account Control) bypass. Specifically:

It creates a new custom shell command path for opening folders.

The key registry property"DelegateExecute"is set, which is a known bypass method. If set without a value, it may cause Windows to run commands with elevated privileges without showing the UAC prompt.

The use ofHKCU(HKEY_CURRENT_USER) rather thanHKLM(HKEY_LOCAL_MACHINE) allows the attacker to bypass permissions since HKCU is writable by the current user. This registry hijack can be leveraged by a malicious actor to execute arbitrary commands with elevated rights.

This is identified in the Cisco CyberOps study material under “UAC bypass techniques,” which describes:

“Attackers often create or modify registry keys like DelegateExecute to hijack the default behavior of applications and elevate privileges”.

Thus, option B is correct: the exhibit demonstrates a UAC bypass using user-accessible registry modification.