Course overview

Download the course datasheetThe full outline for Cisco CCNP Cybersecurity - Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity (CBRFIR), as a PDF.

thinQtank® Learning is offering a unique five-day training camp comprised of five days of instructor-led learning that gives students the knowledge and skills needed to conduct forensic analysis and incident response with Cisco technologies: antiforensics, YARA, memory and log forensics, SIEM and IDS alert analysis, threat intelligence and incident response playbooks.

The camp follows the exam outline Cisco publishes for this certification, with hands-on labs on real and virtual Cisco gear throughout. CBRFIR is the concentration exam for CCNP Cybersecurity, taken with 350-201 CBRCOR.

Cisco, CCST, CCNA, CCNP and CCDE are trademarks or registered trademarks of Cisco Systems, Inc.

This course prepares students to take the 300-215 CBRFIR exam.

What's included

13 items

thinQtank® Learning Accelerated Custom Exam Study Guide for the 300-215 CBRFIR exam

Hands-on lab guide with step-by-step Cisco lab exercises

Custom and focused exam preparation software and materials

Course specific thinQtank® Learning publications to promote a fun and exciting learning

Membership to the thinQtank® Learning University Online

WE DO NOT "TEACH THE TEST" - Students will receive valuable examples and discussion

All courses taught by experienced Cisco-certified engineers

Additional hours of remote lab access

Custom video recordings with even more in-depth learning of course topics

Customized practice exam software

Digital courseware

Retake any or all portions of the course as many times as you like in person or live on-line for 24 months

Six months mentoring access to our engineers after completing the course

What you'll be able to do

10 objectives

Write root cause analysis and incident reports
Analyze memory, logs and malware with Volatility, Sysinternals and SIFT
Interpret SIEM, IDS and syslog alerts
Respond to zero-day attacks and assess risk
Use STIX, TAXII and threat intelligence feeds
Fundamentals: Root cause analysis reports; Antiforensics TTPs and obfuscation; YARA rules; Evidence in virtual/cloud environments
Forensics Techniques: MITRE ATT&CK for fileless malware; IOCs from SIEM and malware analysis; Python/PowerShell/Bash log parsing; Volatility, Sysinternals, SIFT, tcpdump
Incident Response Techniques: Interpret SIEM, IDS/IPS, syslog alerts; Attack vector and mitigation recommendations; Zero-day response and risk assessment; Threat intel feeds and actor profiles
Forensics Processes: Antiforensic techniques; Apache/NGINX log analysis; NetFlow and Wireshark traffic analysis; objdump and binary interpretation
Incident Response Processes: IR goals and playbooks; Threat Grid reports; Endpoint file evaluation; STIX and TAXII

The exam

300-215

90minutes to complete

300-215 CBRFIR
Exam fee set by Cisco: $300 USD per attempt
Cisco does not publish a passing score - we work to the official exam blueprint
Cisco exams are delivered by Pearson VUE at a test center or online proctored - we help you register and schedule your attempt

Who it's for, and what you need first

Target Audience

SOC analysts and incident responders
Digital forensics investigators
Engineers preparing for CCNP Cybersecurity
Service members, veterans and military spouses using AF COOL, Army Credentialing Assistance, MyCAA or VET TEC 2.0

Prerequisites

CCNA Cybersecurity or equivalent SOC experience
CBRCOR recommended

How it's delivered

Instructor-Led Training

Immersive Live-Online Training

On-Site and Custom Delivery

Dates and locations

21 scheduled

Dates	Location	Status
Mon Nov 30 – Dec 4, 20265 days · Mon–Fri	Sterling, VA21481 Ridgetop Cir	Open	Request info
Mon Jan 4 – Jan 8, 20275 days · Mon–Fri	Atlanta, GA431 Marietta St NW	Open	Request info
Mon Jan 11 – Jan 15, 20275 days · Mon–Fri	Burbank, CA3301 N San Fernando Blvd	Open	Request info
Mon Jan 25 – Jan 29, 20275 days · Mon–Fri	Sterling, VA21481 Ridgetop Cir	Open	Request info
Mon Feb 22 – Feb 26, 20275 days · Mon–Fri	Atlanta, GA431 Marietta St NW	Open	Request info
Mon Mar 1 – Mar 5, 20275 days · Mon–Fri	Burbank, CA3301 N San Fernando Blvd	Open	Request info
Mon Mar 22 – Mar 26, 20275 days · Mon–Fri	Sterling, VA21481 Ridgetop Cir	Open	Request info
Mon Apr 19 – Apr 23, 20275 days · Mon–Fri	Atlanta, GA431 Marietta St NW	Open	Request info
Mon Apr 26 – Apr 30, 20275 days · Mon–Fri	Burbank, CA3301 N San Fernando Blvd	Open	Request info
Mon May 17 – May 21, 20275 days · Mon–Fri	Sterling, VA21481 Ridgetop Cir	Open	Request info
Mon Jun 21 – Jun 25, 20275 days · Mon–Fri	Atlanta, GA431 Marietta St NW	Open	Request info
Mon Jun 28 – Jul 2, 20275 days · Mon–Fri	Burbank, CA3301 N San Fernando Blvd	Open	Request info
Mon Jul 12 – Jul 16, 20275 days · Mon–Fri	Sterling, VA21481 Ridgetop Cir	Open	Request info
Mon Aug 9 – Aug 13, 20275 days · Mon–Fri	Atlanta, GA431 Marietta St NW	Open	Request info
Mon Aug 16 – Aug 20, 20275 days · Mon–Fri	Burbank, CA3301 N San Fernando Blvd	Open	Request info
Mon Sep 13 – Sep 17, 20275 days · Mon–Fri	Sterling, VA21481 Ridgetop Cir	Open	Request info
Mon Oct 4 – Oct 8, 20275 days · Mon–Fri	Atlanta, GA431 Marietta St NW	Open	Request info
Mon Oct 18 – Oct 22, 20275 days · Mon–Fri	Burbank, CA3301 N San Fernando Blvd	Open	Request info
Mon Nov 1 – Nov 5, 20275 days · Mon–Fri	Sterling, VA21481 Ridgetop Cir	Open	Request info
Mon Nov 29 – Dec 3, 20275 days · Mon–Fri	Atlanta, GA431 Marietta St NW	Open	Request info
Mon Dec 6 – Dec 10, 20275 days · Mon–Fri	Burbank, CA3301 N San Fernando Blvd	Open	Request info

Guaranteed to run means the class goes ahead whatever the enrollment.

Prices shown are MSRP. Qualified military personnel funding through Air Force COOL, Army Credentialing Assistance, MyCAA or VET TEC 2.0 pay a flat $1,500 per class, whatever the listed price. Everyone else — call 855-868-4467 about group pricing, discounts and current promotions.

Find your exam