Question 1
According to the order of volatility (RFC 3227), which data source must be collected FIRST during live response on a running host?
Correct Answer:
CPU registers and cache
Question 2
Which of the following is a NON-volatile data source on a typical Windows endpoint?
Correct Answer:
NTFS Master File Table on disk
Question 3
An analyst needs to determine which programs were recently executed on a Windows 10 endpoint, even after the user deleted them. Which artifact should be examined?
Correct Answer:
Prefetch files in C:\Windows\Prefetch
Question 4
Which Windows registry hive contains user-specific configuration such as Run keys and recently opened documents?
Correct Answer:
HKEY_CURRENT_USER
Question 5
Which NTFS metadata file records all transactions to the volume and is used to roll back partially completed operations after a crash?
Correct Answer:
$$LogFile
Question 1
Exam overview

About this Exam

Prepare with the Cisco 300-215 CBRFIR Practice Questions - Cisco CBRFIR Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity (300-215) v1.2 Exam practice quiz. This question bank includes 100 questions covering windows, analyst, image, file, and event. Use it to review important concepts, identify knowledge gaps, and build confidence for the related exam, course, or assessment.

More details

Additional Information

Cisco 300-215 CBRFIR Practice Questions - Cisco CBRFIR Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity (300-215) v1.2 Exam

This practice set contains 100 questions from the matching question bank and focuses on windows, analyst, image, file, and event. Work through each question carefully, review the provided solutions, and revisit topics that need more study before your next attempt.

This is an independent study resource intended for practice and review; it is not an official examination or an endorsement by any organization named in the title.

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.
No fixed duration is currently configured for this quiz.
Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.
Yes. You can retake the practice test again as you continue studying during your available access period.
After your access is confirmed, you can continue into the complete practice exam from this quiz flow.
Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.
Keep studying

Related Questions