100+ Free Cisco 300-215 CBRFIR Practice Questions
Pass your Cisco CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity (300-215) v1.2 exam on the first try — instant access, no signup required.
Which statement BEST captures the role of hash values in evidence handling?
Explore More Cisco Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
More From This Family
Videos and articles for deeper review.
Key Facts: Cisco 300-215 CBRFIR Exam
~55-65
Exam Questions
Cisco 300-215 CBRFIR
90 min
Exam Duration
Cisco
~825/1000
Approximate Cut Score
Cisco scaled scoring
$300
Exam Fee
Cisco / Pearson VUE
Professional
Level (CyberOps Concentration)
Cisco CyberOps Professional
3 years
Certification Validity
Cisco recertification cycle
The Cisco 300-215 CBRFIR exam has approximately 55-65 questions delivered in 90 minutes with a $300 USD fee at Pearson VUE. Cisco does not publish a fixed passing percentage; scoring is scaled with the practical cut score commonly cited around 825/1000. Domains: Fundamentals (20%), Forensics Techniques (20%), Incident Response Techniques (30%), Forensics Processes (15%), and Incident Response Processes (15%). It is one of two CyberOps Professional concentration exams — passing 300-215 plus 350-201 CBRCOR earns the Cisco CyberOps Professional certification and the Cisco Certified Specialist - CyberOps Forensic Analysis and Incident Response badge, valid for 3 years.
Sample Cisco 300-215 CBRFIR Practice Questions
Try these sample questions to test your Cisco 300-215 CBRFIR exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.
1According to the order of volatility (RFC 3227), which data source must be collected FIRST during live response on a running host?
2Which of the following is a NON-volatile data source on a typical Windows endpoint?
3An analyst needs to determine which programs were recently executed on a Windows 10 endpoint, even after the user deleted them. Which artifact should be examined?
4Which Windows registry hive contains user-specific configuration such as Run keys and recently opened documents?
5Which NTFS metadata file records all transactions to the volume and is used to roll back partially completed operations after a crash?
6Which Linux file contains a per-user list of commands previously typed at the bash shell?
7On a modern macOS system using APFS, which database records every Spotlight-indexed file system event such as create, rename, and delete?
8An attacker uses a stolen administrative credential to log on to multiple servers via SMB shares using PsExec. Which MITRE ATT&CK technique BEST describes this lateral movement?
9Which MITRE ATT&CK technique is associated with adversaries adding a registry Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence?
10An adversary compresses a malicious payload, base64-encodes it, and embeds it inside a PowerShell EncodedCommand. Which MITRE ATT&CK technique covers this behavior?
About the Cisco 300-215 CBRFIR Exam
Cisco 300-215 CBRFIR (Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity) is a CyberOps Professional concentration exam. It validates the ability to apply digital forensics fundamentals, OS internals (Windows, Linux, macOS), and MITRE ATT&CK to incident response; perform disk and memory acquisition with FTK Imager, dd, and LiME; analyze memory with Volatility (pslist, psscan, netscan, malfind, mftparser); build super-timelines with Plaso/log2timeline; parse browser, registry, and event log artifacts; capture and analyze packets with Wireshark and tcpdump; cover mobile and cloud forensics fundamentals; lead IR triage, scoping, containment, eradication, and recovery using Cisco Secure Endpoint, Cisco XDR, and SecureX/XDR Automation; and apply NIST SP 800-86 forensic methodology and NIST SP 800-61r2 incident response lifecycle from preparation through post-incident review.
Questions
100 scored questions
Time Limit
90 minutes
Passing Score
Cisco does not publish a fixed passing score (scaled scoring; commonly cited ~825/1000)
Exam Fee
$300 (Cisco / Pearson VUE)
Cisco 300-215 CBRFIR Exam Content Outline
Fundamentals
Forensic and IR concepts/definitions, RFC 3227 order of volatility, volatile vs non-volatile data, Windows internals (Registry HKLM/HKCU/HKCR, NTFS $MFT/$LogFile/$UsnJrnl, VSS, Prefetch, ShellBags, AmCache, ShimCache), Linux internals (procfs, sysfs, journald, audit.log, bash_history, .ssh artifacts), macOS internals (HFS+/APFS, FSEvents, KnowledgeC.db, Quarantine, Unified Logs), MITRE ATT&CK techniques (T1021 lateral movement, T1547 persistence, T1068 privilege escalation, T1027 defense evasion), evidence preservation, chain of custody, and legal considerations (search warrant, consent, plain view)
Forensics Techniques
Disk imaging (FTK Imager E01/DD/S01, dd with conv=noerror,sync), memory acquisition (LiME, WinPmem, Magnet RAM Capture), Volatility 3 plugins (pslist, psscan, netscan, malfind, dlllist, hashdump, mftparser, timeliner), Plaso/log2timeline super-timelines, browser artifacts (Chrome History, Firefox places.sqlite, IE/Edge ESE), registry parsing with RegRipper, Windows event IDs (4624, 4625, 4688, 4720, 4769), Sysmon (EID 1/3/7/11/13/19-21), Wireshark display filters (http.request.method, tls.handshake.type, dns.qry.name), tcpdump BPF expressions, mobile (iOS sandbox + APFS, Android Debug Bridge, GrayKey), cloud (AWS CloudTrail, Azure Activity Log, GCP Audit Logs, snapshot acquisition)
Incident Response Techniques
Initial triage and scoping, containment (network segmentation, quarantine VLAN, ISE CoA, host isolation via Cisco Secure Endpoint), eradication (rootkit removal, attacker account/persistence cleanup, image reinstall), recovery (validation, monitoring), Cisco Secure Endpoint Investigation (Orbital live osquery), Cisco Talos IOC enrichment, Cisco XDR unified investigation, SecureX/XDR Automation playbooks, threat hunting in Splunk SPL (4624/4625/4688/4769, Sysmon EID 1/7/13/19-21), Stealthwatch ETA, Umbrella + Investigate DNS hunting, IOC vs IOA development and dissemination (STIX/TAXII), lateral movement (T1021), persistence (T1547), privilege escalation (T1068), credential access (T1003.001 LSASS, T1003.002 SAM, Kerberoasting at 4769)
Forensics Processes
NIST SP 800-86 forensic methodology phases (Collection, Examination, Analysis, Reporting), defensible report writing with reproducibility and contemporaneous notes, Executive Summary versus Technical Findings, working with Legal/HR on internal investigations, evidence handling, hashing (MD5/SHA-256), chain-of-custody documentation including date/time/evidence ID/releaser/recipient/reason, legal hold and spoliation, admissibility considerations
Incident Response Processes
NIST SP 800-61r2 lifecycle (Preparation; Detection & Analysis; Containment, Eradication & Recovery; Post-Incident Activity), CSIRT structure and staffing models (insourced, hybrid, outsourced), Incident Commander and Communications Lead roles, stakeholder communication and reporting cadence (hourly/twice-daily during high-severity), tabletop exercises versus red/purple team engagements, post-incident review and lessons-learned reports with named owners and due dates, MTTD/MTTC/MTTR metrics, threat intelligence integration into IR (Talos, STIX/TAXII)
How to Pass the Cisco 300-215 CBRFIR Exam
What You Need to Know
- Passing score: Cisco does not publish a fixed passing score (scaled scoring; commonly cited ~825/1000)
- Exam length: 100 questions
- Time limit: 90 minutes
- Exam fee: $300
Keys to Passing
- Complete 500+ practice questions
- Score 80%+ consistently before scheduling
- Focus on highest-weighted sections
- Use our AI tutor for tough concepts
Cisco 300-215 CBRFIR Study Tips from Top Performers
Frequently Asked Questions
What is the Cisco 300-215 CBRFIR exam?
Cisco 300-215 CBRFIR (Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity) is a CyberOps Professional concentration exam (v1.2). It validates digital forensics, incident response, and threat hunting skills using NIST SP 800-86, NIST SP 800-61r2, MITRE ATT&CK, and the Cisco Secure portfolio (Secure Endpoint, XDR, Umbrella, Stealthwatch, Talos).
How many questions are on the 300-215 exam?
The Cisco 300-215 CBRFIR exam has approximately 55-65 questions delivered in 90 minutes. Question types include multiple choice (single and multiple response), drag-and-drop, and scenario-based items. Cisco does not publish the exact item count per exam form.
What is the passing score for Cisco 300-215?
Cisco does not publish an exact passing percentage for 300-215. Cisco professional exams are scored on a 300-1000 scale with the practical cut score commonly reported around 825/1000. Cisco may adjust cut scores between forms based on item difficulty.
How much does the Cisco 300-215 exam cost?
The Cisco 300-215 CBRFIR exam costs $300 USD at Pearson VUE. The exam can be taken at a physical Pearson VUE test center or online via OnVUE proctored delivery. Local pricing and taxes may apply.
What certification does 300-215 earn?
Passing 300-215 alone earns the Cisco Certified Specialist - CyberOps Forensic Analysis and Incident Response badge. Combined with 350-201 CBRCOR (the CyberOps Professional core exam), it earns the full Cisco CyberOps Professional certification, valid for 3 years.
How long should I study for Cisco 300-215?
Plan for 80-160 hours of focused study over 2-4 months. Core resources: official Cisco CBRFIR exam topics, the Cisco CBRFIR course (or Cisco U. learning path), NIST SP 800-86 and 800-61r2, MITRE ATT&CK, hands-on with Volatility, FTK Imager, dd, LiME, Wireshark/tcpdump, and Cisco XDR/Secure Endpoint/Umbrella/Stealthwatch. Aim for 85%+ on full-length mocks before scheduling.
What domains and weights are on the 300-215 exam?
The five 300-215 domains are: Fundamentals 20%, Forensics Techniques 20%, Incident Response Techniques 30%, Forensics Processes 15%, and Incident Response Processes 15%. Incident Response Techniques is the largest single domain — focus heavily on Cisco Secure Endpoint, Cisco XDR, threat hunting with MITRE ATT&CK, and IOC/IOA development.