Cisco 300-215 CBRFIR Exam Questions Instant Access

Question 1

Refer to the exhibit.

After a cyber attack, an engineer is analyzing an alert that was missed on the intrusion detection system. The attack exploited a vulnerability in a business-critical, web-based application and violated its availability. Which two mitigation techniques should the engineer recommend? (Choose two.)

Aencapsulation

BNOP sled technique

Caddress space randomization

Dheap-based security

Edata execution prevention

Answer : C, E

The alert indicates a WebDAV Stack Buffer Overflow, which is a memory corruption attack targeting the stack, a common vector for remote code execution or denial-of-service (DoS).

To mitigate such exploits, two effective system-hardening techniques are:

C . Address Space Layout Randomization (ASLR):Randomizes memory addresses used by system and application processes, making it difficult for attackers to predict where their malicious code will be executed.

E . Data Execution Prevention (DEP):Prevents execution of code from non-executable memory regions such as the stack, thus stopping buffer overflow attacks from successfully executing payloads.

Both are well-established protections against stack-based buffer overflow attacks and are strongly recommended in the Cisco CyberOps Associate guide and general security best practices.

Question 2

Refer to the exhibit.

What is the indicator of compromise?

ASHA256 file hash

Bindicator ID: malware--a932fcc6-e032-476c-826f-cb970a569bce

Cindicator type: malicious-activity

DMD5 file hash

Answer : A

The STIX data structure shows a pattern field with this entry:

file:hashes.'SHA-256' = '3299f07bc0711b3587fe8a1c6bf3ee6cbcc14cb775f64b28a61d72ebcb8968d3'

This value is a SHA-256 file hash, a well-known indicator of compromise (IoC) for identifying malicious files.

Therefore, the correct answer is:

A . SHA256 file hash.

Question 3

A cybersecurity analyst is analyzing a complex set of threat intelligence data from internal and external sources. Among the data, they discover a series of indicators, including patterns of unusual network traffic, a sudden increase in failed login attempts, and multiple instances of suspicious file access on the company's internal servers. Additionally, an external threat feed highlights that threat actors are actively targeting organizations in the same industry using ransomware. Which action should the analyst recommend?

AAdvise on monitoring the situation passively because network traffic anomalies are coincidental and unrelated to the ransomware threat.

BPropose isolation of affected systems and activating the incident response plan because the organization is likely under attack by the new ransomware strain.

CAdvocate providing additional training on secure login practices because the increase in failed login attempts is likely a result of employee error.

DNotify of no requirement for immediate action because the suspicious file access incidents are normal operational activities and do not indicate an ongoing threat.

Answer : B

The described scenario includes both internal alerts (unusual network traffic, failed logins, suspicious file access) and external intelligence indicating active ransomware campaigns in the same industry. This constitutes a strong combination of precursors and indicators, as defined in the NIST SP 800-61 incident handling model and reinforced in the Cisco CyberOps Associate curriculum.

According to the Cisco guide:

''Once an incident has occurred, the IR team needs to contain it quickly before it affects other systems and networks within the organization.''

''The containment phase is crucial in stopping the threat from spreading and compromising more systems''.

Given these indicators and the high-value nature of the data involved, it is essential to proactively isolate suspected systems and activate the incident response plan to prevent damage from potential ransomware.

---

Question 4

A cybersecurity analyst must identify an unknown service causing high CPU on a Windows server. What tool should be used?

AVolatility to analyze memory dumps for forensic investigation

BProcess Explorer from the Sysinternals Suite to monitor and examine active processes

CTCPdump to capture and analyze network packets

DSIFT (SANS Investigative Forensic Toolkit) for comprehensive digital forensics

Answer : B

Process Explorer is an advanced Windows-based utility that shows real-time data about running processes, CPU usage, services, DLLs, and handles. It is specifically designed for this kind of investigation and is part of the Sysinternals Suite.

Question 5

Refer to the exhibit.

A web hosting company analyst is analyzing the latest traffic because there was a 20% spike in server CPU usage recently. After correlating the logs, the problem seems to be related to the bad actor activities. Which attack vector is used and what mitigation can the analyst suggest?

ASQL Injection; implement input validation and use parameterized queries.

BDistributed denial of service; use rate limiting and DDoS protection services.

CPhishing attack; conduct regular user training and use email filtering solutions.

DBrute-force attack; implement account lockout policies and roll out MFA.

Answer : D, D

Comprehensive and Detailed

The log entries show repeated SSH login attempts for various invalid usernames (e.g., admin, phoenix, rainbow, test, user, etc.) from different source ports. These are clear signs of a brute-force attack---an automated process trying multiple usernames and passwords in hopes of gaining access.

Mitigating such attacks includes:

Implementing account lockout policies (e.g., locking an account after several failed login attempts).

Enabling Multi-Factor Authentication (MFA) to ensure that password guessing alone is insufficient for account access.

Therefore, the correct answer is:

Question 6

Which tool should be used for dynamic malware analysis?

ADecompiler

BUnpacker

CDisassembler

DSandbox

Answer : D

Dynamic malware analysis involves executing the malware in a controlled environment to observe its behavior, such as file creation, network traffic, or system modifications. A sandbox is designed for this purpose---it safely executes and monitors suspicious code without risking the host system. The other tools (Decompiler, Unpacker, Disassembler) are primarily used in static analysis.

Correct answer: D. Sandbox

---

Question 7

A new zero-day vulnerability is discovered in the web application. Vulnerability does not require physical access and can be exploited remotely. Attackers are exploiting the new vulnerability by submitting a form with malicious content that grants them access to the server. After exploitation, attackers delete the log files to hide traces. Which two actions should the security engineer take next? (Choose two.)

AValidate input upon submission.

BBlock connections on port 443.

CInstall antivirus.

DUpdate web application to the latest version.

EEnable file integrity monitoring.

Answer : A, E

Input validation (A) is a critical countermeasure to defend against command injection and related vulnerabilities, as discussed in the Cisco guide. Proper validation ensures that malicious commands or payloads are not accepted or executed by the web application.

File integrity monitoring (E) helps detect unauthorized changes such as log deletion or binary modification, making it a crucial tool in recognizing and investigating tampering attempts.Blocking port 443 (B) would disable HTTPS and is not a practical solution. Antivirus (C) does not prevent form-based application attacks, and merely updating the application (D) may not be sufficient without addressing the underlying input validation flaw.

---

Cisco Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity 300-215 CBRFIR Exam Questions