Free Cisco 300-215 Practice Questions 2026 | Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

A cybersecurity analyst is examining a complex dataset of threat intelligence information from various sources. Among the data, they notice multiple instances of domain name resolution requests to suspicious domains known for hosting C2 servers. Simultaneously, the intrusion detection system logs indicate a series of network anomalies, including unusual port scans and attempts to exploit known vulnerabilities. The internal logs also reveal a sudden increase in outbound network traffic from a specific internal host to an external IP address located in a high-risk region. Which action should be prioritized by the organization?

A. Threat intelligence information should be marked as false positive because unnecessary alerts impact security key performance indicators.

B. Focus should be applied toward attempts of known vulnerability exploitation because the attacker might land and expand quickly.

C. Organization should focus on C2 communication attempts and the sudden increase in outbound network traffic via a specific host.

D. Data on ports being scanned should be collected and SSL decryption on Firewall enabled to capture the potentially malicious traffic.

Refer to the exhibit.

Which encoding method is used to obfuscate the script?

A. ASCII85 encoding

B. Base64 encoding

C. metamorphic encoding

D. hex encoding

An engineer is investigating a ticket from the accounting department in which a user discovered an unexpected application on their workstation. Several alerts are seen from the intrusion detection system of unknown outgoing internet traffic from this workstation. The engineer also notices a degraded processing capability, which complicates the analysis process. Which two actions should the engineer take? (Choose two.)

A. Restore to a system recovery point.

B. Replace the faulty CPU.

C. Disconnect from the network.

D. Format the workstation drives.

E. Take an image of the workstation.

An incident response analyst is preparing to scan memory using a YARA rule. How is this task completed?

A. deobfuscation

B. XML injection

C. string matching

D. data diddling

A security team received an alert of suspicious activity on a user’s Internet browser. The user’s anti-virus software indicated that the file attempted to create a fake recycle bin folder and connect to an external IP address. Which two actions should be taken by the security analyst with the executable file for further analysis? (Choose two.)

A. Evaluate the process activity in Cisco Umbrella.

B. Analyze the TCP/IP Streams in Cisco Secure Malware Analytics (Threat Grid).

C. Evaluate the behavioral indicators in Cisco Secure Malware Analytics (Threat Grid).

D. Analyze the Magic File type in Cisco Umbrella.

E. Network Exit Localization in Cisco Secure Malware Analytics (Threat Grid).

A threat actor attempts to avoid detection by turning data into a code that shifts numbers to the right four times. Which anti-forensics technique is being used?

A. encryption

B. tunneling

C. obfuscation

D. poisoning

Which tool conducts memory analysis?

A. MemDump

B. Sysinternals Autoruns

C. Volatility

D. Memoryze

Refer to the exhibit.

What is the IOC threat and URL in this STIX JSON snippet?

A. malware; ‘http://x4z9arb.cn/4712/’

B. malware; x4z9arb backdoor

C. x4z9arb backdoor; http://x4z9arb.cn/4712/

D. malware; malware--162d917e-766f-4611-b5d6-652791454fca

E. stix; ‘http://x4z9arb.cn/4712/’

What is the purpose of YARA rules in malware analysis and now do the rules atd in identifying, classifying, and documenting malware?

A. They automatically remove malware from an infected system while documenting the behavior of the APT

B. They encrypt identified malware on a system to prevent execution of files with the same classification

C. They create a backup of identified malware and classify it according to its origin and source

D. They use specific static patterns and attributes to identify and classify matware, characterizing its nature

A security analyst receives a notification from SIEM that an internal host has active connections to Tor exit nodes. The analyst investigates SIEM events related to the workstation and identifies that the host scans networks for servers with an opened TCP port 1433 An antivirus scan of the workstation does not determine any suspicious activity Which two actions must the analyst take to mitigate this behavior? (Choose two.)

A. Configure SIEM alert rules to perform quick response and mitigation

B. Block any connection to TCP port 1433 from external sources.

C. Block Tor nodes via an NGFW and restrict access to SQL only from trusted sources

D. Create a Cisco Secure Network Analytics notification rule to further investigate port scanning activity

E. Deploy EDR and SOAR for automatic quarantine of actions from suspicious hosts