100+ Free Cisco CBRFIR (300-215) Practice Questions
Pass your Cisco CyberOps Professional — Conducting Forensic Analysis and Incident Response Using Cisco Technologies (300-215 CBRFIR) v1.2 exam on the first try — instant access, no signup required.
An IR team wants to isolate a compromised host from the network immediately while preserving the ability to continue remote investigation. Which Cisco Secure Endpoint capability enables this?
Explore More Cisco Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
More From This Family
Videos and articles for deeper review.
Key Facts: Cisco CBRFIR (300-215) Exam
~55–65 items
Exam Questions
Cisco 300-215 CBRFIR blueprint
90 minutes
Exam Duration
Cisco
~825/1000
Approximate Cut Score
Cisco scaled scoring (not officially published)
$300 USD
Exam Fee
Cisco / Pearson VUE
Professional
Certification Level
Cisco CyberOps Professional
3 years
Certification Validity
Cisco recertification policy
The Cisco 300-215 CBRFIR exam has approximately 55–65 questions in 90 minutes and costs $300 USD at Pearson VUE. Cisco uses scaled scoring (approximately 825/1000 cut score) and does not publish a fixed percentage. Five domains: Fundamentals 20%, Forensics Techniques 20%, Incident Response Techniques 30%, Forensics Processes 15%, Incident Response Processes 15%. It is one of two CyberOps Professional concentration exams — combined with 350-201 CBRCOR it earns the Cisco CyberOps Professional certification, valid for 3 years.
Sample Cisco CBRFIR (300-215) Practice Questions
Try these sample questions to test your Cisco CBRFIR (300-215) exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.
1Which MITRE ATT&CK technique ID represents the use of LSASS memory dumping to harvest credential material on Windows?
2During a live Windows IR, an analyst wants to identify all DLLs loaded by a suspicious process. Which Volatility 3 plugin is most appropriate?
3An analyst needs to capture a memory image from a live Linux system without installing a kernel module. Which command accomplishes this using a loadable module approach?
4What does Cisco Secure Endpoint's 'Device Trajectory' feature provide during an IR investigation?
5According to NIST SP 800-61r2, which activity occurs during the 'Post-Incident Activity' phase of the IR lifecycle?
6A forensic analyst is creating a super-timeline of activity on a compromised Windows host. Which tool is most appropriate for this task?
7Which Windows event ID should an analyst correlate to identify Kerberoasting activity in the Security event log?
8What is the primary purpose of the chain of custody in digital forensics?
9An IR team wants to isolate a compromised host from the network immediately while preserving the ability to continue remote investigation. Which Cisco Secure Endpoint capability enables this?
10Which NIST SP 800-86 phase focuses on identifying relevant information within the collected forensic data?
About the Cisco CBRFIR (300-215) Exam
Cisco 300-215 CBRFIR (Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity) is the CyberOps Professional forensics and IR concentration exam. It validates skills across disk, memory, and network forensics; NIST SP 800-86 methodology; NIST SP 800-61r2 IR lifecycle; MITRE ATT&CK technique mapping; Cisco Secure Endpoint investigation; Cisco XDR unified response; and IOC/IOA development using STIX/TAXII. Passing this exam earns the Cisco Certified Specialist — CyberOps Forensic Analysis and Incident Response badge and, combined with 350-201 CBRCOR, the full Cisco CyberOps Professional certification.
Questions
100 scored questions
Time Limit
90 minutes
Passing Score
Cisco does not publish a fixed passing score (scaled scoring; approximately 825/1000 commonly cited)
Exam Fee
$300 USD (Cisco / Pearson VUE)
Cisco CBRFIR (300-215) Exam Content Outline
Fundamentals
RFC 3227 order of volatility, volatile vs non-volatile data, Windows NTFS/$MFT/$UsnJrnl/$LogFile/VSS/Prefetch/ShellBags/Amcache/Shimcache, Linux /proc and sysfs, macOS APFS/KnowledgeC.db/LaunchDaemons, MITRE ATT&CK tactics and techniques, evidence preservation, chain of custody, and legal considerations
Forensics Techniques
FTK Imager E01/DD, dd conv=noerror sync, write blockers, LiME/WinPmem acquisition, Volatility 3 plugins (pslist/psscan/netscan/malfind/dlllist/hashdump/mftparser/timeliner), Plaso/log2timeline super-timelines, registry (NTUSER.DAT/Amcache.hve/RegRipper), Windows event IDs (4624/4688/4769), Sysmon EID 1/3/7/11, Wireshark display filters, tcpdump BPF, mobile (adb/iOS GrayKey), and cloud forensics (AWS CloudTrail/GCP Audit Logs)
Incident Response Techniques
IR triage and scoping, synchronized containment, Cisco Secure Endpoint Device/File Trajectory and Host Isolation, Cisco Orbital osquery queries, Cisco XDR unified investigation and automation playbooks, Cisco Umbrella Investigate, Stealthwatch behavioral alarms, Cisco Talos IOC enrichment, threat hunting in Splunk SPL, STIX 2.1/TAXII 2.1 IOC sharing, and MITRE ATT&CK-mapped IOC/IOA development
Forensics Processes
NIST SP 800-86 four phases (Collection, Examination/reduction, Analysis, Reporting), reproducible technical findings, executive summary structure, MD5/SHA-256 evidence hashing, chain-of-custody form requirements, legal hold and spoliation, and admissibility standards
Incident Response Processes
NIST SP 800-61r2 four phases, CSIRT models (centralized/distributed/coordinating), synchronized containment strategy, stakeholder communication plans (Legal/HR/Executive/PR/Regulatory), tabletop exercise design, post-incident lessons-learned reports with action items, and MTTD/MTTC/MTTR SOC metrics
How to Pass the Cisco CBRFIR (300-215) Exam
What You Need to Know
- Passing score: Cisco does not publish a fixed passing score (scaled scoring; approximately 825/1000 commonly cited)
- Exam length: 100 questions
- Time limit: 90 minutes
- Exam fee: $300 USD
Keys to Passing
- Complete 500+ practice questions
- Score 80%+ consistently before scheduling
- Focus on highest-weighted sections
- Use our AI tutor for tough concepts
Cisco CBRFIR (300-215) Study Tips from Top Performers
Frequently Asked Questions
What is the Cisco 300-215 CBRFIR exam?
Cisco 300-215 CBRFIR (Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity) is a CyberOps Professional concentration exam (v1.2). It validates digital forensics, incident response, and threat hunting skills using NIST SP 800-86, NIST SP 800-61r2, MITRE ATT&CK, Volatility 3, and the Cisco Secure portfolio including Secure Endpoint, XDR, Umbrella, Stealthwatch, and Talos.
How many questions are on the Cisco 300-215 exam?
The Cisco 300-215 CBRFIR exam has approximately 55–65 questions delivered in 90 minutes. Question types include multiple choice (single and multiple response), drag-and-drop, and scenario-based items. Cisco does not publish the exact item count per exam form.
What is the passing score for 300-215 CBRFIR?
Cisco does not publish an exact passing percentage for 300-215. Cisco professional exams use scaled scoring on a 300–1000 scale with the practical cut score commonly cited around 825/1000. Cisco adjusts cut scores between exam forms based on item difficulty calibration.
How much does the 300-215 CBRFIR exam cost?
The Cisco 300-215 CBRFIR exam costs $300 USD at Pearson VUE. The exam can be taken at a physical Pearson VUE test center or online via OnVUE proctored delivery. Local pricing and applicable taxes may vary.
What domains are covered on the 300-215 CBRFIR exam?
The five CBRFIR domains are: Fundamentals (20%), Forensics Techniques (20%), Incident Response Techniques (30%), Forensics Processes (15%), and Incident Response Processes (15%). The largest single domain is Incident Response Techniques — focus heavily on Cisco Secure Endpoint, Cisco XDR, threat hunting with MITRE ATT&CK, and IOC/IOA development with STIX/TAXII.
What certification does the 300-215 exam earn?
Passing 300-215 alone earns the Cisco Certified Specialist — CyberOps Forensic Analysis and Incident Response specialist badge. Combined with 350-201 CBRCOR (the CyberOps Professional core exam), it earns the full Cisco CyberOps Professional certification, valid for 3 years with Cisco's continuing education program.
How long should I study for the 300-215 CBRFIR exam?
Plan 80–160 hours of focused study over 2–4 months. Core resources include: official Cisco CBRFIR exam topics, the Cisco CBRFIR course or Cisco U. learning path, NIST SP 800-86 and 800-61r2, MITRE ATT&CK framework, hands-on practice with Volatility 3, FTK Imager, dd, LiME, Wireshark, tcpdump, and the Cisco XDR/Secure Endpoint/Umbrella/Stealthwatch product suite. Target 85%+ on full-length practice exams before scheduling.