Free 300-215 sample questions
Real questions from the Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity (CBRFIR) practice bank, with the correct answer and an explanation for each one. No junk, no filler.
Try them in the simulator Same questions, with study, timed and flashcard modes.
Showing 10 of 20 free sample questions.
A SOC uses Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) to monitor its AWS environment. An alert is generated for 'Anomalous Port Usage' from an EC2 instance that typically only communicates over TCP/443. The new traffic is a long-lived connection over TCP/6667. What is the most likely cause of this alert?
A security team receives an alert from Cisco Secure Cloud Analytics (Stealthwatch Cloud) indicating that an EC2 instance in their AWS environment is making numerous outbound RDP connections to multiple external IP addresses. Which TWO actions should be taken to mitigate this threat and improve the security posture? (Select TWO)
During a memory forensics investigation of a Windows system using Volatility, an analyst suspects a process hollowing attack. Which plugin should be used to compare the Process Environment Block (PEB) in-memory structure against the on-disk executable to identify this specific type of injection?
A SOC analyst is reviewing Cisco Secure Network Analytics (Stealthwatch) alerts and notices a host exhibiting a 'Custom Security Event - High Concern Index' alarm. The host is making numerous small outbound connections to various IP addresses on non-standard ports, a pattern inconsistent with its baseline behavior. This behavior is indicative of which stage of an attack?
An incident responder is creating a YARA rule to detect a specific malware family that uses a custom XOR encoding routine on its configuration strings. To improve the rule's resilience against minor malware variants, which two sections should be included? (Choose two.)
A financial institution is implementing a new incident response playbook for handling fileless malware attacks that leverage PowerShell. The primary detection tool is Cisco Secure Endpoint, which logs all process command-line arguments. The playbook needs to define a clear, immediate containment step upon detecting a suspicious PowerShell command. Which action is the most effective and appropriate first containment step?
True or False: When performing forensic analysis on a Cisco ASA firewall, the output of `show conn detail` is considered volatile evidence and must be captured before the device is powered down or the connection is terminated.
An investigator is analyzing a malicious binary using `objdump`. The goal is to identify all the external library functions the binary calls, such as `socket` or `CreateProcessA`, to understand its capabilities. Which `objdump` flag should be used to display this information? `objdump ______ malware.exe`
**Case Study:** A healthcare organization suffered a security incident where patient data was exfiltrated. The incident response team has been assembled and is in the eradication phase. Analysis reveals the threat actor gained initial access via a phishing email, installed a persistent backdoor, and then used PsExec for lateral movement to a database server containing the patient records. The actor then compressed the records into a single archive and exfiltrated it over DNS tunneling to an external server. The CISO has tasked the team with ensuring this specific attack chain cannot be repeated. The organization uses Cisco Umbrella for DNS security, Cisco Secure Endpoint for EDR, and Cisco Secure Firewall (FTD) at the perimeter. The team needs to recommend several mitigation techniques that address different stages of this attack. Which combination of actions provides the most comprehensive defense-in-depth strategy to prevent a recurrence of this specific attack chain?
10 more free samples are waiting
Create a free account to unlock the whole 300-215 sample bank, or get full access to all 232 practice questions in the simulator.