Free Cisco 300-215 Practice Questions 2026 | Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

A malware outbreak revealed that a firewall was misconfigured, allowing external access to the SharePoint server. What should the security team do next?

A. Scan for and fix vulnerabilities on the firewall and server

B. Harden the SharePoint server

C. Disable external IP communications on all firewalls

D. Review and update all firewall rules and the network security policy

Refer to the exhibit.

What is occurring?

A. Obfuscated scripts are getting executed on the victim machine.

B. Malware is modifying the registry keys.

C. RDP is used to move laterally to systems within the victim environment.

D. The threat actor creates persistence by creating a repeatable task.

A financial company handling international transactions recently experienced a complex security incident The incident involves simultaneous DDoS attacks, suspected internal data leakage and the discovery of sophisticated malware implants that have remained dormant until triggered remotely During the incident it became clear that the current procedures are inadequate and plans to tackle issues were created on the go To counter this problem going forward, the IR team is developing an incident playbook to be used if a similar incident reoccurs Which set of elements of the playbook must be introduced?

A. Introducing DDoS mitigation procedures, internal data leak investigations, and proactive malware containment

B. Establishing real-time collaboration procedures, increasing data encryption and revising access controls

C. Engaging third-party cybersecurity experts expanding throat intelligence sharing and improving incident documentation

D. Enhancing monitoring protocols, updating firewall rules, and automating traffic analysis tasks efficiently

Data has been exfiltrated and advertised for sale on the dark web. A web server shows:

Database unresponsiveness
PageFile.sys changes
Disk usage spikes with CPU spikes
High page faults

Which action should the IR team perform on the server?

A. Review the database.log file in the program files directory for database errors

B. Examine the system.cfg file in the Windows directory for improper system configurations

C. Analyze the PageFile.sys file in the System Drive and the Virtual Memory configuration

D. Check the Memory.dmp file in the Windows directory for memory leak indications

An investigator is analyzing an attack in which malicious files were loaded on the network and were undetected. Several of the images received during the attack include repetitive patterns. Which anti-forensic technique was used?

A. spoofing

B. obfuscation

C. tunneling

D. steganography

An incident responder reviews a log entry that shows a Microsoft Word process initiating an outbound network connection followed by PowerShell execution with obfuscated commands. Considering the machine's role in a sensitive data department, what is the most critical action for the responder to take next to analyze this output for potential indicators of compromise?

A. Compare the metadata of the Microsoft Word document with known templates to verify its authenticity.

B. Examine the network destination of the outbound connection to assess the credibility and categorize the traffic.

C. Conduct a behavioral analysis of the PowerShell execution pattern and deobfuscate the commands to assess malicious intent.

D. Correlate the time of the outbound network connection with the user's activity log to establish a usage pattern.

An engineer is analyzing a DoS attack and notices that the perpetrator used a different IP address to hide their system IP address and avoid detection. Which anti-forensics technique did the perpetrator use?

A. cache poisoning

B. spoofing

C. encapsulation

D. onion routing

A security team received reports of users receiving emails linked to external or unknown URLs that are non-returnable and non-deliverable. The ISP also reported a 500% increase in the amount of ingress and egress email traffic received. After detecting the problem, the security team moves to the recovery phase in their incident response plan. Which two actions should be taken in the recovery phase of this incident? (Choose two.)

A. verify the breadth of the attack

B. collect logs

C. request packet capture

D. remove vulnerabilities

E. scan hosts with updated signatures

What are two features of Cisco Secure Endpoint? (Choose two.)

A. file trajectory

B. rogue wireless detection

C. Orbital Advanced Search

D. web content filtering

E. full disk encryption

An analyst finds .xyz files of unknown origin that are large and undetected by antivirus. What action should be taken next?

A. Isolate the files and perform a deeper heuristic analysis to detect potential unknown malware or data exfiltration payloads.

B. Rename the file extensions to .txt to enable easier opening and review by team members.

C. Delete the files immediately to prevent potential risks.

D. Move the files to a less secure network segment for analysis.