Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity — Information & Free Practice
US · Examination information
100 free questions · Answer explanations · No signup required
Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity
- Provider
- Cisco Systems, Inc.
- Time limit
- 90 minutes
- Exam fee
- $US300, or use Cisco Learning Credits
Examination outline
Fundamentals (20%)
- Root cause analysis report components
- Infrastructure network device forensics
- Antiforensic tactics, techniques, and procedures
- Encoding and obfuscation techniques
- YARA rules
- DFIR tools and their roles
- Evidence from virtualized environments
Forensics Techniques (20%)
- Fileless malware analysis
- Host file identification and location
- Identify host IOCs from tool output
- Determine code type
- Scripts for parsing and searching logs
- Forensics libraries and tools
Incident Response Techniques (30%)
- Alert log interpretation
- Data correlation by incident type
- Attack vectors and mitigation
- Post-incident actions
- Mitigation for evaluated alerts
- Response to zero-day exploitation
- Response based on intelligence artifacts
- Cisco detection and prevention solutions
- Threat intelligence feeds and indicators
- Threat actor profiles
- Cisco threat intelligence solutions
Forensics Processes (15%)
- Antiforensic techniques
- Web application and server logs
- Malicious network traffic analysis
- File evaluation process
- Binary interpretation
Incident Response Processes (15%)
- Incident response goals
- Incident response playbooks
- ThreatGrid reports
- Endpoint file evaluation and scans
- Threat intelligence formats
Examination sources
- Cisco CBRFIR v1.2 exam topics
page 1/introduction and domains 1–2
- Cisco CBRFIR v1.2 exam topics
page 2/domains 2–5
- CCNP Cybersecurity
Concentration: 300-215 CBRFIR/assessment
- CCNP Cybersecurity
Concentration: 300-215 CBRFIR/grading
- Cisco CBRFIR v1.2 blueprint announcement
page 1/blueprint applicability
- Cisco CBRFIR exam
exam hero/scheduling
Related license preparation
This examination may be required or accepted as an alternative, depending on the license and application pathway.