300-215 Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR) Exam

Duration: 90 minutes
Languages: English

Associated certifications:
Cisco Certified CyberOps Professional
Cisco Certified CyberOps Specialist – CyberOps Forensic Analysis and Incident Response

Exam overview
This exam tests your knowledge and skills related to cybersecurity forensic analysis and incident response, including:

Incident response process and playbooks
Advanced incident response
Threat intelligence
Digital forensics concepts
Evidence collection and analysis
Principles of reverse engineering

Exam preparation
Official Cisco training

Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CyberOps (CBRFIR)

Examkingdom Cisco 300-215 Exam pdf,

Best Cisco 300-215 Free downloads , Cisco 300-215 Dumps at Certkingdom.com

Exam Description:
Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CyberOps v1.0 (CBRFIR 300-215) is a 90-minute exam that is associated with the Cisco CyberOps Professional Certification. This exam tests a candidate’s knowledge of forensic analysis and incident response fundamentals, techniques, and processes. The course Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CyberOps helps candidates to prepare for this exam.
The following topics are general guidelines for the content likely to be included on the exam. However, other related topics may also appear on any specific delivery of the exam. To better reflect the contents of the exam and for clarity purposes, the guidelines below may change at any time without notice.

20% 1.0 Fundamentals
1.1 Analyze the components needed for a root cause analysis report
1.2 Describe the process of performing forensics analysis of infrastructure network devices
1.3 Describe antiforensic tactics, techniques, and procedures
1.4 Recognize encoding and obfuscation techniques (such as, base 64 and hex encoding)
1.5 Describe the use and characteristics of YARA rules (basics) for malware identification, classification, and documentation
1.6 Describe the role of:
1.6.a hex editors (HxD, Hiew, and Hexfiend) in DFIR investigations
1.6.b disassemblers and debuggers (such as, Ghidra, Radare, and Evans Debugger) to perform basic malware analysis
1.6.c deobfuscation tools (such as, XORBruteForces, xortool, and unpacker)
1.7 Describe the issues related to gathering evidence from virtualized environments (major cloud vendors)

20% 2.0 Forensics Techniques
2.1 Recognize the methods identified in the MITRE attack framework to perform fileless malware analysis
2.2 Determine the files needed and their location on the host
2.3 Evaluate output(s) to identify IOC on a host
2.3.a process analysis
2.3.b log analysis
2.4 Determine the type of code based on a provided snippet
2.5 Construct Python, PowerShell, and Bash scripts to parse and search logs or multiple data sources (such as, Cisco Umbrella, Sourcefire IPS, AMP for Endpoints, AMP for Network, and PX Grid)
2.6 Recognize purpose, use, and functionality of libraries and tools (such as, Volatility, Systernals, SIFT tools, and TCPdump)

30% 3.0 Incident Response Techniques
3.1 Interpret alert logs (such as, IDS/IPS and syslogs)
3.2 Determine data to correlate based on incident type (host-based and network-based activities)
3.3 Determine attack vectors or attack surface and recommend mitigation in a given scenario
3.4 Recommend actions based on post-incident analysis
3.5 Recommend mitigation techniques for evaluated alerts from firewalls, intrusion prevention systems (IPS), data analysis tools (such as, Cisco Umbrella Investigate, Cisco Stealthwatch, and Cisco SecureX), and other systems to responds to cyber incidents
3.6 Recommend a response to 0 day exploitations (vulnerability management)
3.7 Recommend a response based on intelligence artifacts
3.8 Recommend the Cisco security solution for detection and prevention, given a scenario
3.9 Interpret threat intelligence data to determine IOC and IOA (internal and external sources)
3.10 Evaluate artifacts from threat intelligence to determine the threat actor profile
3.11 Describe capabilities of Cisco security solutions related to threat intelligence (such as, Cisco Umbrella, Sourcefire IPS, AMP for Endpoints, and AMP for Network)

15% 4.0 Forensics Processes
4.1 Describe antiforensic techniques (such as, debugging, Geo location, and obfuscation)
4.2 Analyze logs from modern web applications and servers (Apache and NGINX)
4.3 Analyze network traffic associated with malicious activities using network monitoring tools (such as, NetFlow and display filtering in Wireshark)
4.4 Recommend next step(s) in the process of evaluating files based on distinguished characteristics of files in a given scenario
4.5 Interpret binaries using objdump and other CLI tools (such as, Linux, Python, and Bash)

15% 5.0 Incident Response Processes
5.1 Describe the goals of incident response
5.2 Evaluate elements required in an incident response playbook
5.3 Evaluate the relevant components from the ThreatGrid report
5.4 Recommend next step(s) in the process of evaluating files from endpoints and performing ad-hoc scans in a given scenario
5.5 Analyze threat intelligence provided in different formats (such as, STIX and TAXII)

QUESTION 1
A security team is discussing lessons learned and suggesting process changes after a security breach incident. During the incident, members of the security team failed to report the abnormal system activity due to
a high project workload. Additionally, when the incident was identified, the response took six hours due to management being unavailable to provide the approvals needed. Which two steps will prevent these issues
from occurring in the future? (Choose two.)

A. Introduce a priority rating for incident response workloads.
B. Provide phishing awareness training for the fill security team.
C. Conduct a risk audit of the incident response workflow.
D. Create an executive team delegation plan.
E. Automate security alert timeframes with escalation triggers.

Correct Answer: AE

QUESTION 2
An engineer is investigating a ticket from the accounting department in which a user discovered an unexpected application on their workstation. Several alerts are seen from the intrusion detection system of
unknown outgoing internet traffic from this workstation. The engineer also notices a degraded processing capability, which complicates the analysis process. Which two actions should the engineer take? (Choose two.)

A. Restore to a system recovery point.
B. Replace the faulty CPU.
C. Disconnect from the network.
D. Format the workstation drives.
E. Take an image of the workstation.

Correct Answer: AE

QUESTION 3
Refer to the exhibit. What should an engineer determine from this Wireshark capture of suspicious network traffic?

A. There are signs of SYN flood attack, and the engineer should increase the backlog and recycle the oldest half-open TCP connections.
B. There are signs of a malformed packet attack, and the engineer should limit the packet size and set a threshold of bytes as a countermeasure.
C. There are signs of a DNS attack, and the engineer should hide the BIND version and restrict zone transfers as a countermeasure.
D. There are signs of ARP spoofing, and the engineer should use Static ARP entries and IP address-to-MAC address mappings as a countermeasure.

Correct Answer: A

Duration: 120 minutes
Languages: English

Associated certifications:
Cisco Certified CyberOps Professional
Cisco Certified CyberOps Specialist – CyberOps Core

Exam overview
This exam tests your knowledge and skills related to core cybersecurity operations, including:
Fundamentals
Techniques
Processes
Automation

Exam preparation
Official Cisco training

Performing CyberOps Using Cisco Security Technologies (CBRCOR) CBRCOR study materials
350-201 CBRCOR Exam: Performing CyberOps Using Cisco Security Technologies v1.0

Exam Description
Performing CyberOps Using Cisco Security Technologies v1.0 (CBRCOR 350-201) is a 120-minute exam that is associated with the Cisco CyberOps Professional Certification. This exam tests a candidate’s knowledge of core cybersecurity operations including cybersecurity fundamentals, techniques, processes, and automation. The course Performing CyberOps Using Cisco Core Security Technologies helps candidates to prepare for this exam.

The following topics are general guidelines for the content likely to be included on the exam. However, other related topics may also appear on any specific delivery of the exam. To better reflect the contents of the exam and for clarity purposes, the guidelines below may change at any time without notice.

Exam Description:
Performing CyberOps Using Cisco Security Technologies v1.0 (CBRCOR 350-201) is a 120-minute exam that is associated with the Cisco CyberOps Professional Certification. This exam tests a candidate’s knowledge of core cybersecurity operations including cybersecurity fundamentals, techniques, processes, and automation. The course Performing CyberOps Using Cisco Security Technologies helps candidates to prepare for this exam.

The following topics are general guidelines for the content likely to be included on the exam. However, other related topics may also appear on any specific delivery of the exam. To better reflect the contents of the exam and for clarity purposes, the guidelines below may change at any time without notice.

Examkingdom Cisco 350-201 Exam pdf,

Best Cisco 350-201 Free downloads , Cisco 350-201 Dumps at Certkingdom.com

20% 1.0 Fundamentals
1.1 Interpret the components within a playbook
1.2 Determine the tools needed based on a playbook scenario
1.3 Apply the playbook for a common scenario (for example, unauthorized elevation of privilege, DoS and DDoS, website defacement)
1.4 Infer the industry for various compliance standards (for example, PCI, FISMA, FedRAMP, SOC, SOX, PCI, GDPR, Data Privacy, and ISO 27101)
1.5 Describe the concepts and limitations of cyber risk insurance
1.6 Analyze elements of a risk analysis (combination asset, vulnerability, and threat)
1.7 Apply the incident response workflow
1.8 Describe characteristics and areas of improvement using common incident response metrics
1.9 Describe types of cloud environments (for example, IaaS platform)
1.10 Compare security operations considerations of cloud platforms (for example, IaaS, PaaS)

30% 2.0 Techniques
2.1 Recommend data analytic techniques to meet specific needs or answer specific questions
2.2 Describe the use of hardening machine images for deployment
2.3 Describe the process of evaluating the security posture of an asset
2.4 Evaluate the security controls of an environment, diagnose gaps, and recommend improvement
2.5 Determine resources for industry standards and recommendations for hardening of systems
2.6 Determine patching recommendations, given a scenario
2.7 Recommend services to disable, given a scenario
2.8 Apply segmentation to a network
2.9 Utilize network controls for network hardening
2.10 Determine SecDevOps recommendations (implications)
2.11 Describe use and concepts related to using a Threat Intelligence Platform (TIP) to automate intelligence
2.12 Apply threat intelligence using tools
2.13 Apply the concepts of data loss, data leakage, data in motion, data in use, and data at rest based on common standards
2.14 Describe the different mechanisms to detect and enforce data loss prevention techniques
2.14.a host-based
2.14.b network-based
2.14.c application-based
2.14.d cloud-based
2.15 Recommend tuning or adapting devices and software across rules, filters, and policies
2.16 Describe the concepts of security data management
2.17 Describe use and concepts of tools for security data analytics
2.18 Recommend workflow from the described issue through escalation and the automation needed for resolution
2.19 Apply dashboard data to communicate with technical, leadership, or executive stakeholders
2.20 Analyze anomalous user and entity behavior (UEBA)
2.21 Determine the next action based on user behavior alerts
2.22 Describe tools and their limitations for network analysis (for example, packet capture tools, traffic analysis tools, network log analysis tools)
2.23 Evaluate artifacts and streams in a packet capture file
2.24 Troubleshoot existing detection rules
2.25 Determine the tactics, techniques, and procedures (TTPs) from an attack

30% 3.0 Processes
3.1 Prioritize components in a threat model
3.2 Determine the steps to investigate the common types of cases
3.3 Apply the concepts and sequence of steps in the malware analysis process:
3.3.a Extract and identify samples for analysis (for example, from packet capture or packet analysis tools)
3.3.b Perform reverse engineering
3.3.c Perform dynamic malware analysis using a sandbox environment
3.3.d Identify the need for additional static malware analysis
3.3.e Perform static malware analysis
3.3.f Summarize and share results
3.4 Interpret the sequence of events during an attack based on analysis of traffic patterns
3.5 Determine the steps to investigate potential endpoint intrusion across a variety of platform types (for example, desktop, laptop, IoT, mobile devices)
3.6 Determine known Indicators of Compromise (IOCs) and Indicators of Attack (IOAs), given a scenario
3.7 Determine IOCs in a sandbox environment (includes generating complex indicators)
3.8 Determine the steps to investigate potential data loss from a variety of vectors of modality (for example, cloud, endpoint, server, databases, application), given a scenario
3.9 Recommend the general mitigation steps to address vulnerability issues
3.10 Recommend the next steps for vulnerability triage and risk analysis using industry scoring systems (for example, CVSS) and other techniques

20% 4.0 Automation
4.1 Compare concepts, platforms, and mechanisms of orchestration and automation
4.2 Interpret basic scripts (for example, Python)
4.3 Modify a provided script to automate a security operations task
4.4 Recognize common data formats (for example, JSON, HTML, CSV, XML)
4.5 Determine opportunities for automation and orchestration
4.6 Determine the constraints when consuming APIs (for example, rate limited, timeouts, and payload)
4.7 Explain the common HTTP response codes associated with REST APIs
4.8 Evaluate the parts of an HTTP response (response code, headers, body)
4.9 Interpret API authentication mechanisms: basic, custom token, and API keys
4.10 Utilize Bash commands (file management, directory navigation, and environmental variables)
4.11 Describe components of a CI/CD pipeline
4.12 Apply the principles of DevOps practices
4.13 Describe the principles of Infrastructure as Code

QUESTION 1
Refer to the exhibit. A threat actor behind a single computer exploited a cloud-based application by sending
multiple concurrent API requests. These requests made the application unresponsive. Which solution protects
the application from being overloaded and ensures more equitable application access across the end-user
community?

A. Limit the number of API calls that a single client is allowed to make
B. Add restrictions on the edge router on how often a single client can access the API
C. Reduce the amount of data that can be fetched from the total pool of active clients that call the API
D. Increase the application cache of the total pool of active clients that call the API

Correct Answer: A

QUESTION 2
DRAG DROP
An organization lost connectivity to critical servers, and users cannot access business applications and
internal websites. An engineer checks the network devices to investigate the outage and determines that all
devices are functioning. Drag and drop the steps from the left into the sequence on the right to continue
investigating this issue. Not all options are used.
Select and Place:

Correct Answer:

QUESTION 3
A threat actor attacked an organization’s Active Directory server from a remote location, and in a thirty-minute
timeframe, stole the password for the administrator account and attempted to access 3 company servers. The
threat actor successfully accessed the first server that contained sales data, but no files were downloaded. A
second server was also accessed that contained marketing information and 11 files were downloaded. When
the threat actor accessed the third server that contained corporate financial data, the session was
disconnected, and the administrator’s account was disabled. Which activity triggered the behavior analytics tool?

A. accessing the Active Directory server
B. accessing the server with financial data
C. accessing multiple servers
D. downloading more than 10 files
Correct Answer: C

QUESTION 4
The physical security department received a report that an unauthorized person followed an authorized
individual to enter a secured premise. The incident was documented and given to a security specialist to analyze.
Which step should be taken at this stage?

A. Determine the assets to which the attacker has access
B. Identify assets the attacker handled or acquired
C. Change access controls to high risk assets in the enterprise
D. Identify movement of the attacker in the enterprise

Correct Answer: D