Logical Operations CFR-210 Online Practice Questions and Exam Preparation

Logical Operations CFR-210 Online Questions & Answers

• Question 81:

  When performing an investigation, a security analyst needs to extract information from text files in a Windows operating system. Which of the following commands should the security analyst use?

  A. findstr
  B. grep
  C. awk
  D. sigverif
  C. awk

• Question 82:

  A Windows system user reports seeing a command prompt window pop up briefly during each login. In which of the following locations would an incident responder check to explain this activity?

  A. rc.d
  B. HKLM "RunOnce" key
  C. c:\temp
  D. /etc/init.d/
  C. c:\temp

  ---

  Explanation/Reference:

• Question 83:

  During a network-based attack, which of the following data sources will provide the BEST data to quickly determine the attacker's point of origin? (Choose two.)

  A. DNS logs
  B. System logs
  C. WIPS logs
  D. Firewall logs
  E. IDS/IPS logs
  A. DNS logs
  D. Firewall logs

• Question 84:

  While reviewing some audit logs, an analyst has identified consistent modifications to the sshd_config file for an organization's server. The analyst would like to investigate and compare contents of the current file with archived versions of files

  that are saved weekly.

  Which of the following tools will be MOST effective during the investigation?

  A. cat * | cut -d ',' -f 2,5,7
  B. more * | grep
  C. diff
  D. sort *
  B. more * | grep

  ---

  Explanation/Reference:

• Question 85:

  A UNIX workstation has been compromised. The security analyst discovers high CPU usage during off-hours on the workstation. Which of the following UNIX programs can be used to detect the rogue process? (Choose two.)

  A. arp
  B. ps
  C. who
  D. dd
  E. top
  C. who
  E. top

  ---

  Explanation/Reference:

• Question 86:

  An organization needs to determine if any systems on its network (10.0.25.0/24) have web services running on port 80 or 443. Which of the following is the BEST command to do this?

  A. netstat -p 80-443 10.0.25.0/24
  B. nmap -v 80,443 10.0.25.0/24
  C. netstat -v 80,443 10.0.25.0/24
  D. nmap -p 80,443 10.0.25.0/24
  C. netstat -v 80,443 10.0.25.0/24

  ---

  Explanation/Reference:

• Question 87:

  

  The above Linux command is used to search for:

  A. MAC addresses.
  B. memory addresses.
  C. IPv4 addresses.
  D. IPv6 addresses.
  A. MAC addresses.

  ---

  Explanation/Reference:

• Question 88:

  Which of the following are reasons that a hacker would execute a DoS or a DDoS attack? (Choose two.)

  A. To determine network bandwidth
  B. To distract the incident response team
  C. To distract the remediation team
  D. To promote business operations
  E. To compromise a system and reuse the IP address
  A. To determine network bandwidth
  B. To distract the incident response team

  ---

  Explanation/Reference:

• Question 89:

  An incident responder suspects that a host behind a firewall is infected with malware.

  Which of the following should the responder use to find the IP address of the infected machine?

  A. NAT table
  B. ARP cache
  C. DNS cache
  D. CAM cable
  C. DNS cache

  ---

  Explanation/Reference:

• Question 90:

  An incident responder is asked to work with the IT department to address patch management issues with the company servers. Which of the following is the BEST source for the incident responder to obtain the CVEs for the latest industry-recognized patches?

  A. Vulnerabilities database
  B. Intelligence feeds
  C. Security journals
  D. Security blogs
  A. Vulnerabilities database

  ---

  Explanation/Reference: