300-215 Exam Dumps : Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

To determine the correct script, we evaluate the following requirements:

The script must search for the IP address 192.168.100.100.

The output should be written to a file named parsed_host.log.

The matching lines should be printed to the console.

Analysis of the options:

Option A: Correct IP regex used and correct output filename, but reads from parsed_host.log instead of a source log file like test_log.log (not ideal for initial parsing).

Option C: The IP address used is 192.168.100.101 instead of 192.168.100.100 — incorrect.

Option D: Same IP address and logic as Option B, but uses print statement without parentheses, which is not valid in Python 3 unless using Python 2 — not ideal.

✅Option B:

Uses correct IP: "192.168.100.100"

Reads from test_log.log (presumably the source log file).

Writes to output/parsed_host.log.

Prints each matching line and writes to output file — satisfying all conditions.

Comprehensive and Detailed Explanation:

The log entries show repeated SSH login attempts for various invalid usernames (e.g., admin, phoenix, rainbow, test, user, etc.) from different source ports. These are clear signs of a brute-force attack—an automated process trying multiple usernames and passwords in hopes of gaining access.

Mitigating such attacks includes:

Implementing account lockout policies (e.g., locking an account after several failed login attempts).

Enabling Multi-Factor Authentication (MFA) to ensure that password guessing alone is insufficient for account access.

Therefore, the correct answer is:

D. Brute-force attack; implement account lockout policies and roll out MFA.

The correct registry path to investigate user profiles and login details is:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ProfileList

This location stores information about each user profile on the machine, including login activity and the LastWrite time for forensic tracking.