Free Cisco 300-215 Practice Questions 2026 | Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

A threat intelligence report identifies an outbreak of a new ransomware strain spreading via phishing emails that contain malicious URLs. A compromised cloud service provider, XYZCloud, is managing the SMTP servers that are sending the phishing emails. A security analyst reviews the potential phishing emails and identifies that the email is coming from XYZCloud. The user has not clicked the embedded malicious URL. What is the next step that the security analyst should take to identify risk to the organization?

A. Reset the reporting user's account and enable multifactor authentication.

B. Create a detailed incident report and share it with top management.

C. Find any other emails coming from the IP address ranges that are managed by XYZCloud.

D. Delete email from user mailboxes and update the incident ticket with lessons learned.

A network host is infected with malware by an attacker who uses the host to make calls for files and shuttle traffic to bots. This attack went undetected and resulted in a significant loss. The organization wants to ensure this does not happen in the future and needs a security solution that will generate alerts when command and control communication from an infected device is detected. Which network security solution should be recommended?

A. Cisco Secure Firewall ASA

B. Cisco Secure Firewall Threat Defense (Firepower)

C. Cisco Secure Email Gateway (ESA)

D. Cisco Secure Web Appliance (WSA)

What is the function of a disassembler?

A. aids performing static malware analysis

B. aids viewing and changing the running state

C. aids transforming symbolic language into machine code

D. aids defining breakpoints in program execution

Refer to the exhibit.

What is occurring?

A. The request was redirected.

B. WAF detected code injection.

C. An attacker attempted SQL injection.

D. The requested page was not found.

An attacker embedded a macro within a word processing file opened by a user in an organization’s legal department. The attacker used this technique to gain access to confidential financial data. Which two recommendations should a security expert make to mitigate this type of attack? (Choose two.)

A. controlled folder access

B. removable device restrictions

C. signed macro requirements

D. firewall rules creation

E. network access control

An organization recovered from a recent ransomware outbreak that resulted in significant business damage. Leadership requested a report that identifies the problems that triggered the incident and the security team’s approach to address these problems to prevent a reoccurrence. Which components of the incident should an engineer analyze first for this report?

A. impact and flow

B. cause and effect

C. risk and RPN

D. motive and factors

Refer to the exhibit.

Which type of code is shown?

A. VBScript

B. shell

C. Bash

D. Python

Which scripts will search a log file for the IP address of 192.168.100.100 and create an output file named parsed_host.log while printing results to the console?

A. Option A

B. Option B

C. Option C

D. Option D

Refer to the exhibit.

A network administrator creates an Apache log parser by using Python. What needs to be added in the box where the code is missing to accomplish the requirement?

A. r'\d(1,3),\d(1.3),\d{13}.df{1,3}'

B. r'*\b'

C. r''\b{1-9}[0-9}\b'

D. r'\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}'

An investigator notices that GRE packets are going undetected over the public network. What is occurring?

A. encryption

B. tunneling

C. decryption

D. steganography