ExamTopics Logo
Mail Us[email protected]
Menu
Cisco Discussions
exam questions

Exam 300-215 All Questions

View all questions & answers for the 300-215 exam
Go to Exam

Exam 300-215 topic 1 question 4 discussion

Actual exam question from Cisco's 300-215
Question #: 4
Topic #: 1
[All 300-215 Questions]


Refer to the exhibit. A network engineer is analyzing a Wireshark file to determine the HTTP request that caused the initial Ursnif banking Trojan binary to download. Which filter did the engineer apply to sort the Wireshark traffic logs?

  • A. http.request.un matches
  • B. tls.handshake.type ==1
  • C. tcp.port eq 25
  • D. tcp.window_size ==0
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️
Reference:
https://www.malware-traffic-analysis.net/2018/11/08/index.html https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-ursnif-infections/
by pinkanemone at June 20, 2022, 2:26 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
[Removed]
8 months, 2 weeks ago
Selected Answer: B
B is right.
upvoted 1 times
...
pinkanemone
2 years, 10 months ago
Ursnif with HTTPS - filter on http.request or ssl.handshake.type == 1 or http.request or tls.handshake.type == 1 https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-ursnif-infections/
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago