Logical Operations CFR-210 Online Practice Questions and Exam Preparation

Logical Operations CFR-210 Online Questions & Answers

• Question 51:

  A security analyst would like to parse through several SQL logs for indicators of compromise. The analyst is aware that none of the fields should contain a string of text longer than 30 characters; however, the analyst is unsure if there are any

  implemented controls to prevent such an overflow.

  Which of the following BEST describes the regular expression the analyst should use to find any alphanumeric character string?

  A. /^[a-zA-Z0-9]{5,30}$/
  B. /^[a-zA-Z-9]{30}$/
  C. /^[a-zA-Z]{5,30}$/
  D. /^[a-Z0-9]{5,30}$/
  A. /^[a-zA-Z0-9]{5,30}$/

  ---

  Explanation/Reference:

• Question 52:

  A malware analyst has been assigned the task of reverse engineering malicious code. To conduct the analysis safely, which of the following could the analyst implement?

  A. Honeypot
  B. VLAN
  C. Lock box
  D. Sandbox
  D. Sandbox

  ---

  Explanation/Reference:

• Question 53:

  A network administrator has been asked to configure a new network. It is the company's policy to segregate network functions using different Virtual LANs (VLANs). On which of the following is this configuration MOST likely to occur?

  A. Network switch
  B. Virtual Machine
  C. Virtual Private Network
  D. Network firewall
  A. Network switch

  ---

  Explanation/Reference:

• Question 54:

  During an annual penetration test, several rootkit-enabled systems are found to be exfiltrating data. The penetration test team and the internal incident response team work to begin cleanup. The company's operations team offers a new

  emails server to use for communications during the incident. As cleanup continues, the attackers seem to know exactly what the incident response plan is.

  Which of the following will prevent the attackers from compromising cleanup activities?

  A. Check the DNS server for rootkits placed by the attackers.
  B. Disconnect the Internet router until all systems can be checked and cleaned.
  C. Use out-of-band communication until the end of the incident.
  D. Disconnect the old emails server until they can be checked and cleaned.
  A. Check the DNS server for rootkits placed by the attackers.

  ---

  Explanation/Reference:

• Question 55:

  An incident responder notices many entries in an apache access log file that contain semicolons. Which of the following attacks is MOST likely being attempted?

  A. SQL injection
  B. Remote file inclusion
  C. Account brute force
  D. Cross-site scripting
  A. SQL injection

  ---

  Explanation/Reference:

• Question 56:

  An outside organization has reported to the Chief Information Officer (CIO) of a company that it has received attack from a Linux system in the company's DMZ. Which of the following commands should an incident responder use to review a list of currently running programs on the potentially compromised system?

  A. task manager
  B. tlist
  C. who
  D. top
  D. top

  ---

  Explanation/Reference:

• Question 57:

  Which of the following is the reason that out-of-band communication is used during a security incident?

  A. The SMTP server may be compromised.
  B. The incident response systems may be busy.
  C. Other communication methods are unreliable.
  D. An attacker could be monitoring network traffic.
  C. Other communication methods are unreliable.

  ---

  Explanation/Reference:

• Question 58:

  A user reports a pop-up error when starting a Windows machine. The error states that the machine has been infected with a virus and instructs the user to download a new antivirus client. In which of the following locations should the incidentresponder check to find what is generating the error message? (Choose two.)

  A. Auto-start registry keys
  B. Device Manager
  C. Event Viewer
  D. Programs and Features
  E. Browser history
  A. Auto-start registry keys
  C. Event Viewer

  ---

  Explanation/Reference:

• Question 59:

  Why is it important to update system clocks from a single time source?

  A. For backup data timestamps
  B. To ensure device data integrity
  C. For log data correlation
  D. To assist in network data packet capture
  B. To ensure device data integrity

• Question 60:

  An alert on user account activity outside of normal business hours returns Windows even IDs 540 and 4624. In which of the following locations will these events be found?

  A. Application event log
  B. System event log
  C. Setup event log
  D. Security event log
  D. Security event log

  ---

  Explanation/Reference: