Logo ExamsQA
Exit
Official Bank 0/131

Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR) Exam (300-215) - Cisco Exam Questions

Last updated on June 22, 2026

97% Exam Compliance
131 Total Questions
1
Question
An attacker embedded a macro within a word processing file opened by a user in an organization’s legal department. The attacker used this technique to gain access to confidential financial data.

Which two recommendations should a security expert make to mitigate this type of attack? (Choose two.)
Select 2
Options
A network access control
B removable device restrictions
C controlled folder access
D firewall rules creation
E signed macro requirements
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

2
Question
A security team needs to prevent a remote code execution vulnerability. The vulnerability can be
exploited only by sending '${ string in the HTTP request. WAF rule is blocking '${', but system
engineers detect that attackers are executing commands on the host anyway. Which action should the security team recommend?
Options
A Enable URL decoding on WAF.
B Block incoming web traffic.
C Deploy antimalware solution.
D Add two WAF rules to block 'S' and '{' characters separately.
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

3
Question
Refer to the exhibit.

Exhibit

Which type of code is being used?
Options
A Shell
B VBScript
C Python
D BASH
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

4
Question
A malware outbreak revealed that a firewall was misconfigured, allowing external access to the SharePoint server. What should the security team do next?
Options
A Harden the SharePoint server
B Scan for and fix vulnerabilities on the firewall and server
C Review and update all firewall rules and the network security policy
D Disable external IP communications on all firewalls
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

5
Question
Refer to the exhibit.

Exhibit

What is the indicator of compromise?
Options
A SHA256 file hash
B indicator ID: malware--a932fcc6-e032-476c-826f-cb970a569bce
C MD5 file hash
D indicator type: malicious-activity
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

Finish Practice?

Are you sure you want to finish? This will end your practice session.