Cisco 300-215 - Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

In therecovery phase, the goal is to restore affected systems to normal operations and ensure the threat has been completely eradicated. According to the CyberOps Associate guide:

"This phase may include restoring data from clean backups, replacing compromised systems, and the re-installation of the Operating System (OS) and applications".

Also:

"During recovery, scanning hosts with updated antivirus and removing vulnerabilities ensures systems do not get reinfected".

Process injectionis a tactic where malicious code is inserted into the memory space of another process, enabling it to run with the privileges and context of a legitimate application. The Cisco study guide explains that this method allows malware to "hide in plain sight" within trusted processes and evade endpoint detection and response (EDR) tools.

It specifically notes:"Process injection techniques allow malware to execute within the memory space of a legitimate process, avoiding detection and taking advantage of the process's permissions.".

The goal of an incident response plan (IRP) is to provide structured procedures for responding to cybersecurity incidents in a way that limits damage, contains the threat, and ensures business continuity. As outlined in the NIST SP 800-61 and Cisco CyberOps Associate study guide, containment and minimizing the impact of incidents is the primary goal of an IRP.

—

The STIX intelligence feed in the exhibit identifies specific malicious domains, such as:

fightcovid19.shop

nocovid19.shop

stopcovid19.shop

These are categorized as “Malicious FQDN Indicator.” The recommended cybersecurity actions when such threat intelligence is received are:

D. Block network access to identified domains: This directly prevents users or systems from communicating with known malicious infrastructure and is a critical first step in threat mitigation.

B. Add a SIEM rule to alert on connections to identified domains: This ensures that any attempted communication with these domains is flagged for immediate review and action, enabling real-time threat detection and incident response.

Blocking all .shop domains (Option A or C) would be overbroad and potentially disruptive, as many legitimate websites also use that TLD. Option E (routing to block hole) could be valid as a DNS strategy, but B and D represent the most actionable and precise responses per standard incident response practices.