Cisco 300-215 CBRFIR case studies
Cisco 300-215 CBRFIR · Put your knowledge to work in context.
The Cisco 300-215 CBRFIR exam is a Cisco certification exam focused on cybersecurity operations and incident response. This page is an independent study resource: it is not affiliated with, endorsed by, or sponsored by Cisco, and it does not reproduce any official question bank. The Cisco 300-215 CBRFIR case studies are 5 cases and about 2,417 words.
1Ransomware Containment with Backups at Risk
At 02:14 on Tuesday, Cisco Secure Endpoint raises 'Suspicious Ransomware Behavior' on 37 Windows hosts and the file server FS01 begins renaming documents to .locked. Telemetry shows service creation consistent with PsExec from WKS-042, SMB sessions to 10.20.4.0/24, and a 300-second TLS beacon from WKS-042 to 185.199.108.77.
522 words, about 3 min2Valid-Account VPN Takeover After MFA Fatigue
At 03:07, Cisco ISE logs a VPN authentication for account 'jdoe' from 198.51.100.23 in Country A after 11 denied MFA pushes in 4 minutes; the user's normal login is 203.0.113.45 in Country B. The identity provider shows the MFA acceptance came from a new device, and the user's laptop has been offline for 6 hours.
483 words, about 2 min3Environment-Aware Malware Beyond Sandbox Timeout
An employee opens an email attachment named 'Invoice 2024.iso' at 10:42. The ISO contains a .lnk that runs a signed binary with a sideloaded DLL.
470 words, about 2 min4DNS Tunneling from a Finance Workstation
Secure Network Analytics reports finance workstation FIN-WS-22 sending 4.2 GB outbound over 72 hours to 203.0.113.90, a cloud VPS. Umbrella logs show 18,000 DNS TXT queries to random 32-character subdomains of 'sync-data[.]xyz'; the workstation normally sends less than 20 MB/day.
462 words, about 2 min5Unauthorized PLC Change During a Production Batch
A plant uses Cisco Cyber Vision sensors on a mirrored SPAN port. At 14:05, Cyber Vision flags a new PLC program download from ENG-WS-03 to PLC-07 on the production line; the engineering change ticket is for a different PLC and expired yesterday.
480 words, about 2 min