Cisco 300-215 CBRFIR flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

NIST IR lifecycle phases

Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. These four phases form the SP 800-61r2 incident response lifecycle used to structure response activities.

MTTD definition

Mean Time to Detect is the average elapsed time between the initial compromise and its detection. It measures detection effectiveness and is reduced by better telemetry, tuning, and threat intelligence.

MTTR definition

Mean Time to Respond is the average elapsed time from detection to containment or resolution. It measures response efficiency and is shortened by playbooks, automation, and clear decision authority.

Security incident vs event

An event is any observable occurrence in a system or network. An incident is an actual or suspected event that violates security policy or threatens operations, requiring response.

Chain of custody

Documented, unbroken control of evidence from collection to disposal. Each transfer records who handled it, what was done, when, where, and why, preserving admissibility.

Order of volatility

Collect most volatile evidence first: CPU registers and cache, routing and ARP tables, memory, temporary files, disk, remote logs, then archival media. Defined in RFC 3227.

Incident commander role

The person with decision authority during an incident. They coordinate the CSIRT, approve containment actions, and own communications escalation, while analysts execute technical tasks.

Lessons learned phase

The final post-incident activity that reviews timeline, root cause, and response effectiveness. Outputs include updated detection rules, playbooks, and control improvements with assigned owners.

Snort GID and SID

Generator ID identifies the rule source: GID 1 for text rules, GID 3 for shared object rules. SID uniquely identifies the rule; revision tracks rule updates.

Cisco Secure Firewall intrusion policy

A policy that references Snort rules and variable sets to detect exploits and policy violations. It is invoked from an access control rule's inspection action.

Stealthwatch exfiltration detector

A Cisco Secure Network Analytics detector that flags hosts sending unusually large outbound data volumes relative to baseline, indicating possible data theft.

Umbrella DNS-layer enforcement

Cisco Umbrella blocks malicious domains at DNS resolution before a TCP connection is made. Policies are applied per identity and roam with the device.

Secure Endpoint device trajectory

A graphical view in Cisco Secure Endpoint showing process lineage and file ancestry for a detection, helping analysts determine root cause and scope.

Threat Grid threat score

A 0-100 score from Cisco Secure Malware Analytics summarizing behavioral severity of a submitted sample. Higher scores indicate more malicious observed behavior.

SecureX threat response graph

A visual correlation of observables across integrated Cisco products, showing sightings and relationships to support investigation and scoping.

Syslog severity levels

Numerical levels 0 emergency through 7 debug. Lower numbers are more severe; filtering by severity reduces noise in SIEM and log collection.

Talos intelligence role

Cisco Talos publishes vulnerability and threat research, IOCs, and blog analyses, and supports incident response engagements through Talos IR.

Prefilter policy function

A Cisco Secure Firewall policy evaluated before access control that can fast-path trusted traffic or block and tunnel traffic, reducing inspection load.

Forensic image verification

Compute a cryptographic hash such as SHA-256 of the source and the image and record both in the evidence log to demonstrate integrity.

Write blocker purpose

A hardware or software device that prevents write operations to a source drive during acquisition, preserving evidence integrity and defensibility.

ACPO principles

Four UK forensic principles: no change to data, access by competent persons, an audit trail of actions, and case officer responsibility for compliance.

Cisco IOS show tech-support

A command that bundles comprehensive device diagnostics including configuration, logs, and interface state, useful for evidence collection and vendor support cases.

ASA capture command

Captures packets matching an ACL into memory on Cisco ASA. Captures are volatile and must be exported before reboot or cleared.

NetFlow evidence value

Flow records provide 5-tuple, byte counts, and timestamps for network conversations, supporting timeline reconstruction and scoping when full packet capture is unavailable.

Remote syslog retention

Exporting device logs to a remote collector preserves evidence across reboots and buffer clears, supporting investigation of network device events.

Cisco ISE CoA quarantine

Identity Services Engine sends a Change of Authorization to a network device to apply a quarantine authorization profile, isolating an endpoint.

Containment strategy selection

Choose host isolation, perimeter or DNS blocking, network segmentation, or account disable based on blast radius, business impact, and attacker awareness.

Eradication versus recovery

Eradication removes the root cause such as malware or vulnerable software. Recovery restores normal operations and validates with monitoring before closing the incident.

GDPR breach notification clock

Controllers must notify the supervisory authority of a personal data breach within 72 hours of becoming aware, where feasible and required.

IOC block documentation

Each block in firewall or DNS policy should be tied to a ticket with justification, owner, and expiry to prevent stale blocks and support audit.

Post-incident report contents

Executive summary, timeline, root cause, IOCs, actions taken, business impact, and recommendations with owners and due dates.

Recovery validation steps

Confirm clean images, patched systems, reset credentials, and re-enabled services under monitoring before declaring recovery complete.