View Full Cisco 300-220 Exam Dumps and Practice Test Dumps

 

Question 241.

Which evidence can reveal unauthorized changes to endpoint security exclusions?

1. DNS resolver status
2. Monitor power state
3. Keyboard activity
4. Security configuration events

Correct Answer: 4

Explanation:

Security configuration events can reveal changes to exclusions, protection settings, scanning policies, or other endpoint security controls. Attackers may attempt to weaken security mechanisms before executing additional activity. Analysts should examine which setting changed, the previous and new values, the initiating account, process, and timestamp. DNS status, monitor power state, and keyboard activity do not directly provide this configuration visibility. Legitimate administrators and security software updates can also modify protection settings, so analysts should compare the event with approved change records. Correlating configuration changes with process execution and subsequent security events can help determine whether the modification requires investigation.

Question 242.

What helps determine whether an unusual executable is digitally trusted?

1. Digital signature validation
2. Network hop count
3. Account lockout duration
4. File compression level

Correct Answer: 1

Explanation:

Digital signature validation can help determine whether an executable carries a valid signature from a recognized publisher. This provides useful information about software provenance and integrity, although a valid signature does not automatically prove that the file is safe. Analysts should verify the signer, certificate status, file location, hash, and expected software context. Network hop count, account lockout duration, and compression level do not establish executable trust. Signature information is most useful when combined with endpoint telemetry and software inventory. A suspicious unsigned file may deserve additional scrutiny, while a signed file should still be evaluated for unexpected behavior or misuse.

Question 243.

Which network observation may indicate unauthorized use of a dormant account?

1. Successful authentication from an unfamiliar source
2. Normal password expiration
3. Routine software installation
4. Scheduled backup activity

Correct Answer: 1

Explanation:

A successful authentication from an unfamiliar source can be significant when the account has historically been inactive or rarely used. Analysts should examine the account’s previous activity, source device, authentication method, target system, and timing. Dormant accounts can become attractive targets because unusual activity may otherwise receive less attention. Normal password expiration, software installation, and scheduled backups do not directly establish suspicious account use. The authentication itself is not proof of compromise, because legitimate administrative or recovery activity may explain it. Reviewing identity records alongside endpoint and network telemetry can help establish whether the access was expected or requires investigation.

Question 244.

Which process attribute helps identify where an executable was launched from?

1. CPU usage
2. Parent process ID
3. Executable path
4. Memory pressure

Correct Answer: 3

Explanation:

The executable path identifies the location from which a process was launched and can provide valuable context during endpoint investigations. An executable running from an unexpected temporary directory, user profile location, or unusual system path may warrant additional examination. CPU usage and memory pressure describe resource consumption, while the parent process ID identifies process ancestry rather than the executable’s location. Analysts should compare the path with approved software locations, file ownership, digital signatures, and installation records. Path information becomes more useful when correlated with process creation time, command-line arguments, user identity, and network activity.

Question 245.

Why examine archive creation during a potential data-theft investigation?

1. To measure display refresh
2. To identify possible data staging
3. To determine keyboard layout
4. To inspect printer queues

Correct Answer: 2

Explanation:

Archive creation can indicate that files are being consolidated before another action, including possible transfer or exfiltration. Attackers may package multiple files into an archive to simplify movement or reduce the number of individual transfers. However, archive creation is also common during legitimate backups, software distribution, and administrative workflows. Analysts should examine the archive location, creator process, account, file contents, creation time, and any subsequent network connections. Display refresh, keyboard layout, and printer queues do not provide useful evidence about data staging. Correlating archive activity with file-access events and outbound transfers can provide stronger investigative context.

Question 246.

Which evidence helps identify the account responsible for a configuration change?

1. DNS cache contents
2. Authentication and audit records
3. File extension counts
4. Network interface speed

Correct Answer: 2

Explanation:

Authentication and audit records can associate configuration changes with the account or session that performed the action. This attribution is important when determining whether a change was made by an authorized administrator, service account, automated process, or potentially compromised identity. DNS cache contents, file extension counts, and network interface speed do not directly establish who performed a configuration change. Analysts should correlate the change timestamp with authentication sessions, administrative activity, endpoint processes, and change-management records. Attribution should remain evidence-based because shared accounts, automation, delegated administration, and incomplete logging can complicate the relationship between an observed change and the individual responsible.

Question 247.

What pattern may indicate unusual use of a service account?

1. Consistent scheduled execution
2. Approved application access
3. Interactive login from a workstation
4. Expected database connection

Correct Answer: 3

Explanation:

An interactive login from a workstation can be unusual for a service account if that account normally performs automated or application-based tasks. Service accounts are often configured for specific workloads and may not ordinarily require interactive user sessions. Analysts should review the account’s normal purpose, authentication source, timing, privileges, and subsequent activity. Scheduled execution, approved application access, and expected database connections may represent normal service-account behavior. An interactive login is not automatically malicious because administrators may legitimately use service identities during maintenance. The key is whether the observed behavior differs from the account’s established operational baseline and has supporting evidence of unauthorized activity.

Question 248.

Which record can help identify repeated access to a sensitive database?

1. Database audit logs
2. Display configuration
3. Audio driver events
4. Mouse movement

Correct Answer: 1

Explanation:

Database audit logs can provide direct visibility into database authentication, queries, accessed objects, and other activity depending on the configured auditing level. Repeated access to sensitive records can therefore be investigated using these logs alongside user identity and application context. Display configuration, audio driver events, and mouse movement do not provide meaningful database-access information. Analysts should determine whether the observed queries match the user’s role and expected application behavior. High-volume access may be legitimate for reporting or application workloads, so the investigation should consider normal usage patterns. Correlation with endpoint and network telemetry can further clarify the source of the activity.

Question 249.

Which characteristic can help distinguish automated traffic from interactive browsing?

1. Monitor resolution
2. File ownership
3. Highly regular request timing
4. Password age

Correct Answer: 3

Explanation:

Highly regular request timing can be a useful characteristic when distinguishing automated traffic from interactive browsing. Scripts, scheduled processes, and automated clients may generate requests at consistent intervals or predictable rates. Human browsing usually produces more variable timing, although this distinction is not definitive. Analysts should also examine user agents, destination patterns, request volume, initiating processes, and historical behavior. Monitor resolution, file ownership, and password age do not directly characterize network request timing. Regularity can support an investigative hypothesis, but it should be combined with other evidence before concluding that traffic is automated or suspicious.

Question 250.

What should be checked when a suspicious binary has an unusual filename?

1. Screen orientation
2. File metadata and provenance
3. Printer queue size
4. Network cable type

Correct Answer: 2

Explanation:

File metadata and provenance can provide important context when an executable has an unusual filename. Analysts can examine its creation time, modification details, source, path, signer, hash, associated process, and method of arrival. An unusual name alone is weak evidence because legitimate applications may use temporary or randomly generated filenames. Screen orientation, printer queues, and cable type do not help establish executable provenance. Comparing the file against known software inventories and trusted repositories can further clarify its legitimacy. Correlating the binary with process execution, user activity, and network communication can help determine whether the file represents a meaningful security concern.

Question 251.

Which event may reveal an application attempting to disable security services?

1. Service state modification
2. Browser bookmark creation
3. Screen brightness adjustment
4. Printer configuration

Correct Answer: 1

Explanation:

Service state modification can reveal attempts to stop, disable, or alter security-related services. Such activity may be relevant when investigating efforts to weaken endpoint protection or evade monitoring. Analysts should identify which service changed, who initiated the change, the process responsible, and whether an approved maintenance action explains it. Browser bookmarks, screen brightness, and printer configuration do not directly indicate service-state changes. Legitimate security updates and troubleshooting can also restart or modify services, so context is essential. Correlating service changes with process execution, administrative authentication, and subsequent endpoint activity can help determine whether the event represents normal maintenance or suspicious behavior.

Question 252.

Why compare endpoint configuration with an approved baseline?

1. To increase network latency
2. To identify unauthorized deviations
3. To remove configuration records
4. To change user passwords

Correct Answer: 2

Explanation:

Comparing endpoint configuration with an approved baseline helps identify deviations that may result from unauthorized changes, software installations, or security-control tampering. A baseline can include services, startup settings, security policies, installed software, and other system characteristics. Analysts should investigate meaningful differences while recognizing that legitimate updates and administrative changes can also modify the baseline. Increasing latency, removing records, and changing passwords do not describe the purpose of configuration comparison. Effective baseline analysis requires current reference information and appropriate environmental context. Repeated comparisons can also help identify gradual configuration drift that might otherwise remain unnoticed.

Question 253.

Which evidence can associate a network connection with a specific process?

1. Process-to-socket telemetry
2. Display resolution
3. Account expiration date
4. Printer inventory

Correct Answer: 1

Explanation:

Process-to-socket telemetry can associate network connections with the local processes responsible for creating them. This relationship is valuable because a destination address alone may not explain why communication occurred. Analysts can examine the process identifier, executable path, destination, port, protocol, and connection time. Display resolution, account expiration date, and printer inventory do not provide equivalent network attribution. Process-to-network correlation can reveal unexpected applications communicating with unusual destinations or approved applications making abnormal connections. Analysts should validate the process against application behavior and asset role before classifying the connection as suspicious.

Question 254.

Which behavior may suggest an account is being used outside its assigned role?

1. Normal role-based access
2. Approved application usage
3. Unexpected administrative activity
4. Routine scheduled execution

Correct Answer: 3

Explanation:

Unexpected administrative activity can suggest that an account is being used outside its assigned role, especially when the account normally performs ordinary user or application functions. Analysts should examine the account’s permissions, historical activity, source device, accessed systems, and timing. Normal role-based access, approved application usage, and routine scheduled execution may be expected behaviors. Administrative activity should not automatically be considered malicious because temporary elevation and authorized support work are common. The key is determining whether the activity matches documented responsibilities and approved procedures. Identity logs, endpoint telemetry, and change records can help establish the legitimacy of the observed behavior.

Question 255.

What can reveal whether an endpoint recently received a new software package?

1. Deployment or installation records
2. Screen saver settings
3. Audio volume history
4. Keyboard shortcuts

Correct Answer: 1

Explanation:

Deployment or installation records can establish whether an endpoint recently received a software package. These records may include package names, versions, installation times, target systems, and deployment mechanisms. Such information is useful when an unfamiliar executable or service appears shortly after a software rollout. Screen saver settings, audio volume history, and keyboard shortcuts do not provide reliable installation context. Analysts should correlate installation records with process creation, file creation, service registration, and network activity. Authorized deployment evidence can explain otherwise unusual endpoint events and helps reduce false positives during threat-hunting investigations.

Question 256.

Which network behavior may warrant investigation on a workstation that rarely serves connections?

1. Accepting inbound service requests
2. Routine DNS resolution
3. Normal software updates
4. Standard time synchronization

Correct Answer: 1

Explanation:

Accepting inbound service requests can warrant investigation on a workstation that normally operates primarily as a client. Unexpected listening services or inbound connections may indicate newly enabled software, remote administration, configuration changes, or potentially unauthorized activity. Routine DNS resolution, software updates, and time synchronization are common workstation behaviors. Analysts should identify the listening process, port, account, service configuration, and source addresses associated with inbound requests. Legitimate applications can create temporary listeners, so the behavior must be evaluated against the endpoint’s role and software inventory. Historical network data can help determine whether the service is genuinely new or simply infrequently observed.

Question 257.

Which artifact can show that a process accessed a particular registry location?

1. Registry access telemetry
2. Network packet loss
3. Display adapter data
4. Printer driver status

Correct Answer: 1

Explanation:

Registry access telemetry can show when processes interact with specific registry locations, depending on the endpoint monitoring capabilities available. This information can support investigations involving configuration changes, persistence mechanisms, credential-related activity, or software behavior. Analysts should examine the process, registry path, operation type, account, and timestamp. Network packet loss, display adapter data, and printer driver status do not directly reveal registry access. Registry activity should be interpreted in context because legitimate software frequently reads and modifies registry settings. Combining registry telemetry with process ancestry and file activity can help determine whether an observed change is expected or suspicious.

Question 258.

What can help determine whether a suspicious command was launched by a document application?

1. Parent-child process relationship
2. DNS record age
3. File compression ratio
4. Account password length

Correct Answer: 1

Explanation:

The parent-child process relationship can show whether a command interpreter or other suspicious process was launched by a document application. This relationship is particularly useful when investigating unexpected execution chains. Analysts can review the parent executable, child process, command-line arguments, user account, and timestamps. DNS record age, file compression ratio, and password length do not establish process ancestry. Document applications can legitimately launch helper processes, so an unusual relationship should be compared against normal application behavior and known software functionality. Additional evidence from file access, network connections, and security telemetry can help determine whether the execution chain represents potentially malicious behavior.

Question 259.

Which evidence can reveal that an executable was launched immediately after download?

1. Monitor brightness records
2. File and process timestamps
3. Printer configuration
4. Network adapter model

Correct Answer: 2

Explanation:

File and process timestamps can help determine whether an executable was launched shortly after it was downloaded or created. By comparing the relevant timestamps, analysts can reconstruct the sequence from acquisition to execution. Additional evidence such as the initiating process, download source, user account, and file path can strengthen the timeline. Monitor brightness, printer configuration, and network adapter model do not establish this relationship. Timestamp interpretation requires care because different telemetry sources may use different clocks or collection delays. Analysts should account for time synchronization and logging differences when reconstructing a detailed execution sequence.

Question 260.

What should be documented when a hunt produces a confirmed suspicious finding?

1. Only the analyst’s name
2. Supporting evidence and reasoning
3. The system wallpaper
4. Unrelated hardware details

Correct Answer: 2

Explanation:

A confirmed suspicious finding should be documented with the supporting evidence and reasoning that led to the conclusion. Useful documentation includes the original hypothesis, relevant telemetry, affected systems, accounts, timestamps, investigative steps, validation results, and remaining uncertainties. Recording only the analyst’s name or unrelated hardware information does not preserve the investigative context. Clear documentation allows other analysts to understand and validate the finding and can support detection engineering or incident-response activities. The evidence should distinguish directly observed facts from assumptions or interpretations. Maintaining this distinction improves the quality and reproducibility of subsequent security investigations.