Demo Preview

300-215 CBRFIR Safe Question Preview

This public preview shows limited demo-safe questions only. Correct answers, full explanations, paid-only media, private IDs, and attempt data are not included.

Forensics TechniquesIncident Response TechniquesMultiple Choice
Start Interactive DemoExam Landing Page

Preview Questions

Multiple ChoiceForensics Techniques
Question 1. What is the function of a disassembler?
A. aids performing static malware analysis
B. aids viewing and changing the running state
C. aids transforming symbolic language into machine code
D. aids defining breakpoints in program execution
Open safe question previewReport Question
Multiple ChoiceForensics Techniques
Question 2. Refer to the exhibit. What does the exhibit indicate?
A. The new file is created under the Software\Classes disk folder.
B. A UAC bypass is created by modifying user-accessible registry settings.
C. A scheduled task named "DelegateExecute" is created.
D. The shell software is modified via PowerShell.
Open safe question previewReport Question
Multiple ChoiceIncident Response Techniques
Question 3. Refer to the exhibit. An engineer received a ticket to analyze a recent breach on a company blog. Every time users visit the blog, they are greeted with a message box. The blog allows users to register, log in, create, and provide comments on various topics. Due to the legacy build of the application, it stores user information in the outdated MySQL database. What is the recommended action that an engineer should take?
A. Validate input on arrival as strictly as possible.
B. Implement TLS 1.3 for external communications.
C. Match the web server software for the front-end and back-end servers.
D. Upgrade the MySQL database.
Open safe question previewReport Question
Multiple ChoiceForensics Techniques
Question 4. Over the last year, an organization’s HR department has accessed data from its legal department on the last day of each month to create a monthly activity report. An engineer is analyzing suspicious activity alerted by a threat intelligence platform that an authorized user in the HR department has accessed legal data daily for the last week. The engineer pulled the network data from the legal department’s shared folders and discovered above average-size data dumps. Which threat actor is implied from these artifacts?
A. privilege escalation
B. internal user errors
C. malicious insider
D. external exfiltration
Open safe question previewReport Question
Multiple ChoiceForensics Techniques
Question 5. Refer to the exhibit.
A. Initiate a connection to 23.1.4.14 over port 8443.
B. Generate a Windows executable file.
C. Open the Mozilla Firefox browser.
D. Validate the SSL certificate for 23.1.4.14.
Open safe question previewReport Question