Released Cisco 300-215 CBRFIR Training Questions
Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies 300-215 CBRFIR training questions have been released, which are valuable for you to study the test. Cisco 300-215 CBFIR exam is a required test for Cisco CyberOps Professional certification, which also requires you to pass Cisco certification 350-201 CBRCOR test. The latest Cisco 300-215 CBFIR exam information is helpful in the preparation.
Cisco 300-215 CBFIR Exam Information
Cisco certification 350-201 CBRCOR exam tests your knowledge of forensic analysis and incident response fundamentals, techniques, and processes.
Associated certifications: Cisco Certified CyberOps Professional, Cisco Certified CyberOps Specialist-CyberOps Forensic Analysis and Incident Response
Duration: 90 minutes
Available languages: English
CyberOps Professional 300-215 CBFIR Exam Topics
Learn 300-215 CBFIR Exam Training Questions
Cisco certification 300-215 CBFIR exam training questions can help you test all the above topics. Share some Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies 300-215 CBRFIR training questions and answers below.
1.What is a concern for gathering forensics evidence in public cloud environments?
A. High Cost: Cloud service providers typically charge high fees for allowing cloud forensics.
B. Configuration: Implementing security zones and proper network segmentation.
C. Timeliness: Gathering forensics evidence from cloud service providers typically requires substantial time.
D. Multitenancy: Evidence gathering must avoid exposure of data from other tenants.
Answer: D
2.An organization recovered from a recent ransomware outbreak that resulted in significant business damage. Leadership requested a report that identifies the problems that triggered the incident and the security team’s approach to address these problems to prevent a reoccurrence. Which components of the incident should an engineer analyze first for this report?
A. impact and flow
B. cause and effect
C. risk and RPN
D. motive and factors
Answer: D
3.An engineer is analyzing a ticket for an unexpected server shutdown and discovers that the web-server ran out of useable memory and crashed.Which data is needed for further investigation?
A. /var/log/access.log
B. /var/log/messages.log
C. /var/log/httpd/messages.log
D. /var/log/httpd/access.log
Answer: B
4.An engineer received a report of a suspicious email from an employee. The employee had already opened the attachment, which was an empty Word document. The engineer cannot identify any clear signs of compromise but while reviewing running processes, observes that PowerShell.exe was spawned by cmd.exe with a grandparent winword.exe process.What is the recommended action the engineer should take?
A. Upload the file signature to threat intelligence tools to determine if the file is malicious.
B. Monitor processes as this a standard behavior of Word macro embedded documents.
C. Contain the threat for further analysis as this is an indication of suspicious activity.
D. Investigate the sender of the email and communicate with the employee to determine the motives.
Answer: A
5.A security team received reports of users receiving emails linked to external or unknown URLs that are non-returnable and non-deliverable. The ISP also reported a 500% increase in the amount of ingress and egress email traffic received. After detecting the problem, the security team moves to the recovery phase in their incident response plan.Which two actions should be taken in the recovery phase of this incident? (Choose two.)
A. verify the breadth of the attack
B. collect logs
C. request packet capture
D. remove vulnerabilities E. scan hosts with updated signatures
Answer: DE
