Cisco CBRFIR: Forensic Analysis and Incident Response exam guide

Exam 300-215 CBRFIR

CBRFIR (300-215) validates forensic analysis and incident response fundamentals, techniques and processes using Cisco technologies. With CBRCOR it earns CCNP Cybersecurity.

QuestionsSee official page

Time limit90 minutes

Passing scoreSee official page

Exam fee$300 USD

Valid for3 years

DeliveryProctored at a test center or online, scheduled through Cisco's certification portal

Format: Multiple choice (single and multiple answer), drag-and-drop, and simulation/testlet-style items; pass/fail. Fee note: Cisco Learning Credits accepted.

Who it's for

Incident responders and forensic analysts in SOC or DFIR teams.

What the exam covers

Fundamentals—

Forensics Techniques—

Incident Response Techniques—

Forensics Processes—

Incident Response Processes—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: None.

Recommended: Three to five years in security operations or incident response.

Keeping it active

Passing earns a Cisco Certified Specialist credential valid 3 years (renew with 40 CE credits or by passing a qualifying exam). The exam itself also counts toward recertifying CCNP/CCIE.

Skills & careers

Skills it validates

Endpoint and memory forensics
Network traffic and log forensics
Malware and file analysis
Evidence handling and chain of custody
Incident scoping, containment and eradication
Using Cisco Secure Endpoint, Secure Malware Analytics and XDR for IR

Job roles

Incident ResponderDigital Forensics AnalystDFIR AnalystSOC AnalystThreat Analyst

Where it fits in your path

Take before

Cisco CBRCOR: Performing CyberOps Using Cisco Security Technologies Cisco CCNA Cybersecurity (formerly CyberOps Associate)

Go next

GIAC Certified Forensic Analyst (GCFA)GIAC Certified Incident Handler (GCIH)EC-Council Computer Hacking Forensic Investigator (C|HFI)

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

Week 1: Forensics fundamentals, evidence handling, Windows/Linux artifacts.
Week 2: Memory and disk analysis tools; practice with sample images.
Week 3: Network and log forensics; PCAP analysis.
Week 4: IR processes and Cisco tooling; practice exams.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam date Hours per week

Exam-day tips

Expect artifact-interpretation items: logs, process trees, PCAP excerpts.
Know order of volatility and correct evidence collection sequence.
Understand what Cisco Secure Endpoint and Malware Analytics reports show.
Review common Windows persistence locations.

Key terms for this exam

Triage Collection Digital Forensics Evidence Integrity Forensic Image Order of Volatility Write Blocker Dynamic Malware Analysis Live Acquisition Memory Forensics Network Forensics Static Malware Analysis Timeline Analysis

All 12 terms Study with thinQcards™

Frequently asked questions

How much does the CBRFIR exam cost?

US$300 per attempt, or Cisco Learning Credits.

Does CBRFIR alone give me CCNP Cybersecurity?

No. CCNP Cybersecurity requires the core exam plus one concentration exam. Passing CBRFIR by itself earns a Cisco Certified Specialist credential.

What is the passing score?

Cisco does not publish passing scores or question counts; the score needed varies by exam form and is reported as pass/fail with a section breakdown.

How hard is CBRFIR?

It is a 90-minute professional-level exam that assumes CCNA-level knowledge plus hands-on experience with forensics and incident response. Candidates without real lab time usually struggle.

CBRFIR or another concentration?

Choose CBRFIR for DFIR roles; choose 300-220 CBRTHD if you focus on proactive threat hunting.

Official page: www.cisco.com. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.

1. Map it thinQguide™ · 409 cert guides 2. Learn it thinQterms™ · 7,491 terms 3. Untangle it 180 look-alike comparisons 4. Prove it thinQready™ · free readiness check

Find your exam