Cisco Exam 300-215 Topic 7 Question 68 Discussion

Actual exam question for Cisco's 300-215 exam

Question #: 68
Topic #: 7

Refer to the exhibit.

A network engineer is analyzing a Wireshark file to determine the HTTP request that caused the initial Ursnif banking Trojan binary to download. Which filter did the engineer apply to sort the Wireshark traffic logs?

Ahttp.request.un matches

Btls.handshake.type ==1

Ctcp.port eq 25

Dtcp.window_size ==0

Show Suggested Answer

Suggested Answer: D

by Lavonna at Jan 23, 2024, 11:14 PM

Limited Time Offer

25%

Off

Get Premium 300-215 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Marti

1 months ago

I have to say, these Wireshark filters are starting to sound like Klingon to me. Why can't they just call it 'Find the Bad Guy' filter?

upvoted 0 times

Page

6 days ago

User 3: It's all about finding the needle in the haystack.

upvoted 0 times

...

Irving

14 days ago

User 2: I agree, it feels like learning a new language.

upvoted 0 times

...

Fredric

18 days ago

User 1: I know right, these filters can be so confusing.

upvoted 0 times

...

Amie

2 months ago

D) tcp.window_size ==0? What kind of weird filter is that? I'm pretty sure the answer has to be one of the HTTP-related options. Maybe Jolanda is onto something with that http.request.un matches filter.

upvoted 0 times

Jettie

2 days ago

I agree, let's go with that option for sorting the Wireshark traffic logs.

upvoted 0 times

...

Aleisha

3 days ago

Yeah, that filter seems more relevant to finding the HTTP request for the Ursnif banking Trojan.

upvoted 0 times

...

Mammie

5 days ago

I think Jolanda might be right with the http.request.un matches filter.

upvoted 0 times

...

Albina

2 months ago

Hmm, I was leaning towards C) tcp.port eq 25, since that could detect the SMTP traffic associated with the malware. But I guess the HTTP request is the more direct way to identify the initial download.

upvoted 0 times

Herman

16 days ago

User3: I agree, it's the most direct way to identify the Ursnif banking Trojan binary download.

upvoted 0 times

...

Haley

1 months ago

User2: Yeah, that filter would specifically target the HTTP request we are looking for.

upvoted 0 times

...

Kenneth

1 months ago

User1: I think the correct filter is A) http.request.un matches

upvoted 0 times

...

Alisha

2 months ago

I was thinking B) tls.handshake.type ==1 might be the right answer, since the Ursnif malware is likely using encrypted communication. But you make a good point, A) is probably the best choice here.

upvoted 0 times

...

Jolanda

2 months ago

I'm pretty sure the answer is A) http.request.un matches. The question is specifically asking about the HTTP request that triggered the Ursnif download, so that filter seems like the most relevant one.

upvoted 0 times

...