View Full Cisco 300-220 Exam Dumps and Practice Test Dumps

 

Question 261.

Which evidence can identify a process that modified another process?

1. DNS response data
2. Screen activity
3. Process-access telemetry
4. Printer status

Correct Answer: 3

Explanation:

Process-access telemetry can provide visibility into interactions between processes, including situations where one process accesses another process’s memory or handles. Such activity can be relevant when investigating process injection, credential theft, or other techniques involving abnormal process interaction. Analysts should examine the initiating process, target process, access type, account, and timestamp. DNS response data, screen activity, and printer status do not directly establish process-to-process access. Legitimate security software and debugging tools may also interact with processes, so context is important. Correlating process-access events with process ancestry, executable paths, and subsequent behavior can help determine whether the activity requires investigation.

Question 262.

What helps identify whether a DNS query is unusual for a host?

1. Historical DNS baseline
2. Printer configuration
3. File compression method
4. Display driver status

Correct Answer: 1

Explanation:

A historical DNS baseline helps determine which domains, query types, and request frequencies are normal for a particular host. Comparing current DNS activity against that baseline can reveal unusual destinations, excessive query volumes, or previously unseen patterns. Printer configuration, compression methods, and display drivers do not provide meaningful DNS context. Analysts should consider the host’s role and installed applications because specialized systems can legitimately generate uncommon queries. Additional context such as domain age, reputation, query frequency, and initiating process can strengthen the investigation. Baseline analysis is most effective when updated periodically to reflect legitimate changes in the environment.

Question 263.

Which event may expose unauthorized changes to endpoint firewall rules?

1. Browser history
2. Audio settings
3. Firewall configuration events
4. Keyboard preferences

Correct Answer: 3

Explanation:

Firewall configuration events can reveal additions, removals, or modifications to endpoint firewall rules. Unexpected rule changes may allow unwanted inbound or outbound communication and can therefore be relevant during security investigations. Analysts should examine the rule direction, ports, protocols, applications, initiating account, and modification time. Browser history, audio settings, and keyboard preferences do not directly provide firewall configuration visibility. Legitimate administrators and software installations may create firewall rules, so analysts should compare changes with approved deployment and maintenance records. Correlating firewall modifications with process execution and network activity can help establish whether the rule change had a legitimate purpose.

Question 264.

Why correlate a file hash with software inventory data?

1. To measure network delay
2. To determine software identity
3. To alter file permissions
4. To remove duplicate events

Correct Answer: 2

Explanation:

Correlating a file hash with software inventory data can help determine whether a binary belongs to known and approved software. A matching hash can provide stronger identification than a filename because filenames can be changed easily. Analysts should also verify the software version, installation path, publisher, and deployment records. Network delay, file permissions, and duplicate-event removal do not establish software identity. Hash comparisons are especially useful when investigating unfamiliar executables or validating files discovered during a hunt. However, analysts should account for legitimate updates because a new software version will normally have a different hash from its predecessor.

Question 265.

Which behavior may indicate an application is accessing credentials unexpectedly?

1. Routine configuration loading
2. Normal update activity
3. Approved authentication
4. Unusual credential-store access

Correct Answer: 4

Explanation:

Unusual credential-store access can indicate that an application is attempting to obtain authentication material outside its expected function. Analysts should determine which process accessed the credential store, which account was involved, when the access occurred, and whether the application normally requires such access. Routine configuration loading, software updates, and approved authentication can be legitimate activities. Credential-store access is therefore best evaluated against application behavior and historical baselines. Additional evidence from process ancestry, command-line activity, and subsequent network communication can strengthen the investigation. The presence of credential access alone does not establish malicious intent because some legitimate applications require stored credentials.

Question 266.

Which telemetry can reveal repeated failed attempts against a privileged account?

1. File metadata
2. Authentication events
3. Screen resolution
4. Printer logs

Correct Answer: 2

Explanation:

Authentication events can reveal repeated failed attempts against privileged accounts and provide information about sources, timestamps, authentication methods, and targeted identities. A pattern of repeated failures may indicate password guessing, misconfigured services, or other authentication problems. Analysts should compare the activity with expected administrative behavior and investigate whether successful authentication followed the failures. File metadata, screen resolution, and printer logs do not directly provide authentication evidence. Privileged account activity deserves careful contextual analysis because both legitimate administrative tools and malicious automation can generate repeated attempts. Correlating failures with source addresses and endpoint processes can help distinguish these possibilities.

Question 267.

What can reveal whether a suspicious script originated from an email attachment?

1. Screen-lock events
2. Network interface speed
3. File provenance and email telemetry
4. CPU temperature

Correct Answer: 3

Explanation:

File provenance and email telemetry can help establish whether a suspicious script originated from an email attachment. Analysts can correlate the attachment, sender, message timestamp, extracted filename, endpoint file creation, and subsequent execution. This relationship can help reconstruct how the script reached the system. Screen-lock events, network interface speed, and CPU temperature do not provide meaningful evidence about email-based file delivery. Analysts should also inspect the process that opened or executed the file and any network connections that followed. Email-origin evidence should be validated against available endpoint records because attachment extraction and file renaming can alter the visible filename or path.

Question 268.

Why compare process execution frequency across similar endpoints?

1. To identify uncommon behavior
2. To change endpoint ownership
3. To remove process history
4. To increase storage capacity

Correct Answer: 1

Explanation:

Comparing process execution frequency across similar endpoints can identify behavior that is uncommon within a peer group. This approach is useful because a process may be normal for one specialized system but unusual across ordinary workstations. Analysts can compare execution counts, user populations, locations, parent processes, and time periods. Changing ownership, removing history, and increasing storage capacity do not support behavioral analysis. Peer-group comparison should account for differences in software versions, business roles, and administrative responsibilities. An uncommon process is an investigative signal rather than proof of malicious activity, so analysts should validate it using additional endpoint and network evidence.

Question 269.

Which artifact can expose unexpected modifications to scheduled jobs on Linux?

1. DHCP records
2. Browser bookmarks
3. Cron configuration
4. Display settings

Correct Answer: 3

Explanation:

Cron configuration can reveal scheduled jobs configured to execute commands automatically on Linux systems. Unexpected entries may indicate persistence, unauthorized automation, or administrative changes that require validation. Analysts should inspect the command, schedule, owner, file location, creation or modification time, and associated user. DHCP records, browser bookmarks, and display settings do not directly reveal scheduled-job configuration. Legitimate maintenance tasks commonly use cron, so analysts should compare entries with approved operational processes. Correlating cron changes with file creation, process execution, and account activity can help determine whether a newly observed job represents expected administration or potentially unauthorized persistence.

Question 270.

Which network evidence can identify a host communicating over an unexpected protocol?

1. File creation time
2. Flow metadata
3. Account expiration
4. Registry values

Correct Answer: 2

Explanation:

Flow metadata can reveal protocols, ports, endpoints, connection timing, and traffic patterns. This information can help identify a host using a protocol that differs from its normal communication profile. Analysts should compare the observed protocol with the system’s role and expected applications. File creation time, account expiration, and registry values may provide useful endpoint context but do not directly establish network protocol usage. Unexpected protocol activity can result from legitimate application changes, troubleshooting, or new deployments. Correlating flow metadata with the initiating process, service configuration, and historical communication baseline can help determine whether the behavior warrants additional investigation.

Question 271.

What should be examined when a process suddenly consumes unusual network bandwidth?

1. Desktop theme
2. Keyboard settings
3. Printer configuration
4. Process and destination details

Correct Answer: 4

Explanation:

Process and destination details can help explain why a process is suddenly consuming unusual network bandwidth. Analysts should identify the executable, user, destination addresses, ports, protocol, transfer timing, and historical behavior. High bandwidth usage can result from legitimate backups, synchronization, updates, or media applications, but it can also support investigations involving data transfer. Desktop themes, keyboard settings, and printer configuration do not explain network consumption. Correlating the bandwidth event with file-access and process activity can help determine whether sensitive data was involved. Asset role and expected application behavior should also be considered before classifying the traffic as suspicious.

Question 272.

Which evidence helps determine whether a new account was created by an administrator?

1. Account creation audit trail
2. DNS cache contents
3. File extension data
4. Network packet size

Correct Answer: 1

Explanation:

An account creation audit trail can identify when a new account was created and, depending on available logging, which administrative identity or process initiated the action. Analysts can review the target account, creator, timestamp, assigned groups, and related authentication activity. DNS cache contents, file extensions, and packet size do not directly establish account creation responsibility. New accounts can be legitimate for employees, applications, contractors, or temporary administration, so context is essential. Correlating account creation with change-management records and subsequent activity can help determine whether the account was authorized. Privileged group membership should receive additional scrutiny because it can significantly expand access.

Question 273.

Which observation can support a hypothesis of lateral movement?

1. Local wallpaper change
2. Remote authentication to multiple hosts
3. Routine browser update
4. Normal screen locking

Correct Answer: 2

Explanation:

Remote authentication to multiple hosts can support a lateral-movement hypothesis when the pattern is unusual for the account or originating system. Analysts should examine the sequence of destinations, authentication methods, account privileges, timing, and initiating process. Administrative users may legitimately access many systems, so the observation requires contextual validation. Wallpaper changes, browser updates, and screen locking do not directly support lateral movement. Correlating remote authentication with process execution, network connections, and subsequent activity on destination systems can strengthen the investigation. A well-defined baseline for administrative access helps distinguish normal management activity from unexpected host-to-host movement.

Question 274.

What can identify a process that created a suspicious archive?

1. Process lineage telemetry
2. DHCP lease duration
3. Monitor model
4. Account password age

Correct Answer: 1

Explanation:

Process lineage telemetry can identify the process responsible for creating a suspicious archive and show how that process was launched. This is valuable when investigating potential data staging or unauthorized compression. Analysts should examine the parent process, executable path, command-line arguments, account, archive location, and creation time. DHCP lease duration, monitor model, and password age do not directly identify archive creation activity. Legitimate backup utilities and administrative tools may also create archives, so the process should be compared with approved software and expected workflows. Correlating archive creation with file-access events and outbound communication can provide additional evidence about the purpose of the activity.

Question 275.

Which signal may indicate an endpoint is attempting DNS tunneling?

1. Normal application startup
2. Routine software installation
3. Excessive encoded-looking DNS queries
4. Standard time synchronization

Correct Answer: 3

Explanation:

Excessive encoded-looking DNS queries can be a signal associated with possible DNS tunneling. Tunneling techniques may use DNS queries to transport information through domains and subdomains, sometimes producing unusually long, high-entropy, or repetitive query strings. However, legitimate applications can also generate complex DNS names, so the pattern should not be treated as proof by itself. Analysts should examine query frequency, domain ownership, response behavior, entropy, host role, and initiating process. Normal application startup, software installation, and time synchronization do not specifically indicate tunneling. Historical DNS behavior can help determine whether the observed query pattern represents a meaningful deviation.

Question 276.

Why correlate endpoint telemetry with identity events?

1. To calculate monitor resolution
2. To connect actions with accounts
3. To change DNS settings
4. To remove file metadata

Correct Answer: 2

Explanation:

Correlating endpoint telemetry with identity events helps associate technical actions with the accounts involved in those actions. For example, process execution, configuration changes, or file access can become more meaningful when linked to the authenticated user or service identity. This correlation supports investigation of unauthorized activity and helps establish a timeline. Monitor resolution, DNS changes, and file-metadata removal are unrelated to the purpose of identity correlation. Analysts should account for shared accounts, service identities, delegated administration, and incomplete logs when interpreting attribution. Combining identity information with process and network telemetry provides stronger context than examining any single source independently.

Question 277.

Which evidence may reveal an executable communicating shortly after first execution?

1. File ownership alone
2. Process and network timestamps
3. Printer inventory
4. Screen brightness

Correct Answer: 2

Explanation:

Process and network timestamps can help establish whether an executable initiated network communication shortly after its first execution. This sequence can be important when investigating newly introduced software, suspicious downloads, or potential command-and-control activity. Analysts should compare process creation time, file creation time, connection time, destination, and initiating account. File ownership alone cannot establish the sequence, while printer inventory and screen brightness are unrelated. Timestamp correlation should account for differences between data sources and clock synchronization. When combined with executable hashes, parent processes, and destination context, the timeline can provide stronger evidence for understanding the executable’s behavior.

Question 278.

What helps identify whether an observed command was executed interactively?

1. Session and logon context
2. File compression level
3. DNS cache age
4. Display orientation

Correct Answer: 1

Explanation:

Session and logon context can help determine whether a command was executed within an interactive user session or by an automated process. Analysts can examine the associated account, session identifier, logon type, terminal information, and execution time. This distinction can be important when investigating commands that may have been launched manually versus through scheduled tasks or services. File compression, DNS cache age, and display orientation do not directly establish execution context. Analysts should correlate session information with process ancestry and command-line telemetry to build a reliable picture. Service accounts and remote sessions require additional context because they may not resemble ordinary interactive activity.

Question 279.

Which finding can strengthen a hypothesis involving unauthorized persistence?

1. Routine DNS resolution
2. Normal application startup
3. Unexpected startup entry plus execution
4. Approved software installation

Correct Answer: 3

Explanation:

An unexpected startup entry combined with corresponding execution provides stronger evidence for a persistence hypothesis than either observation alone. Analysts can investigate the entry’s creation time, executable path, associated account, parent process, and whether the program actually executed during subsequent logons or system starts. Routine DNS resolution, normal application startup, and approved software installation may represent expected activity. Persistence mechanisms should always be validated against legitimate software and administrative changes. Correlating startup configuration with process creation, file metadata, and change-management records can help determine whether the observed mechanism was intentionally deployed or represents an unauthorized modification.

Question 280.

What should be done when multiple independent indicators support the same hunt hypothesis?

1. Discard the earliest evidence
2. Validate and document the finding
3. Disable related telemetry
4. Remove the investigation scope

Correct Answer: 2

Explanation:

When multiple independent indicators support the same hypothesis, analysts should validate the evidence and document the finding. Independent observations can increase confidence when they align logically across time, systems, accounts, and telemetry sources. Validation should still consider legitimate explanations and gaps in available data. Discarding evidence, disabling telemetry, or removing investigation scope would reduce the ability to establish what occurred. Documentation should include the hypothesis, supporting indicators, affected assets, timestamps, investigative methods, and remaining uncertainties. A validated finding can then support additional hunting, detection development, or incident-response activity while preserving a clear record of the reasoning behind the conclusion.