CertNexus CertNexus Certification CFR-310 Questions & Answers

• Question 31:

  Organizations considered "covered entities" are required to adhere to which compliance requirement?

  A. Health Insurance Portability and Accountability Act of 1996 (HIPAA)

  B. Payment Card Industry Data Security Standard (PCI DSS)

  C. Sarbanes-Oxley Act (SOX)

  D. International Organization for Standardization (ISO) 27001

  Correct Answer: A

  Reference: https://www.hhs.gov/hipaa/for-professionals/faq/190/who-must-comply-with-hipaa-privacystandards/index.html

• Question 32:

  Which of the following is the GREATEST risk of having security information and event management (SIEM) collect computer names with older log entries?

  A. There may be duplicate computer names on the network.

  B. The computer name may not be admissible evidence in court.

  C. Domain Name System (DNS) records may have changed since the log was created.

  D. There may be field name duplication when combining log files.

  Correct Answer: D

• Question 33:

  A first responder notices a file with a large amount of clipboard information stored in it. Which part of the MITRE ATTandCK matrix has the responder discovered?

  A. Collection

  B. Discovery

  C. Lateral movement

  D. Exfiltration

  Correct Answer: D

  Reference: https://resources.infosecinstitute.com/mitre-attck-clipboard-data/#gref

• Question 34:

  Tcpdump is a tool that can be used to detect which of the following indicators of compromise?

  A. Unusual network traffic

  B. Unknown open ports

  C. Poor network performance

  D. Unknown use of protocols

  Correct Answer: A

  Reference: https://books.google.com.pk/books? id=b7swDwAAQBAJandpg=PA122andlpg=PA122anddq=Tcpdump+is+a+tool+that+can+be+used+to+detect +which+of+the+following+indicators+of +compromiseandsource=blandots=RxkWHHpNC4andsig=ACfU3U2L48OSw8R8HdLy2ytAuYsRDi9Hmgandhl=enand sa=Xandved=2ahUKEwi44PjnybbpAhVNzIUKHSloCJgQ6AEwAHoECBMQAQ#v=onepageandq=Tcpdump% 20is%20a%20tool%20that% 20can%20be%20used%20to%20detect%20which%20of%20the%20following %20indicators%20of%20compromiseandf=false

• Question 35:

  When attempting to determine which system or user is generating excessive web traffic, analysis of which of the following would provide the BEST results?

  A. Browser logs

  B. HTTP logs

  C. System logs

  D. Proxy logs

  Correct Answer: D

  Reference: https://www.exabeam.com/siem-guide/events-and-logs/

• Question 36:

  When tracing an attack to the point of origin, which of the following items is critical data to map layer 2 switching?

  A. DNS cache

  B. ARP cache

  C. CAM table

  D. NAT table

  Correct Answer: B

  The host that owns the IP address sends an ARP reply message with its physical address. Each host machine maintains a table, called ARP cache, used to convert MAC addresses to IP addresses. Since ARP is a stateless protocol, every time a host gets an ARP reply from another host, even though it has not sent an ARP request for that reply, it accepts that ARP entry and updates its ARP cache. The process of updating a target host's ARP cache with a forged entry is referred to as poisoning.

  Reference: https://www.researchgate.net/ publication/221056734_Securing_Layer_2_in_Local_Area_Networks

• Question 37:

  Various logs are collected for a data leakage case to make a forensic analysis. Which of the following are MOST important for log integrity? (Choose two.)

  A. Hash value

  B. Time stamp

  C. Log type

  D. Modified date/time

  E. Log path

  Correct Answer: AB

• Question 38:

  A security analyst has discovered that an application has failed to run. Which of the following is the tool MOST likely used by the analyst for the initial discovery?

  A. syslog

  B. MSConfig

  C. Event Viewer

  D. Process Monitor

  Correct Answer: C

• Question 39:

  A Windows system administrator has received notification from a security analyst regarding new malware

  that executes under the process name of "armageddon.exe" along with a request to audit all department

  workstations for its presence.

  In the absence of GUI-based tools, what command could the administrator execute to complete this task?

  A. ps -ef | grep armageddon

  B. top | grep armageddon

  C. wmic process list brief | find "armageddon.exe"

  D. wmic startup list full | find "armageddon.exe"

  Correct Answer: C

  Reference: https://www.andreafortuna.org/2017/08/09/windows-command-line-cheatsheet-part-2-wmic/

• Question 40:

  During a log review, an incident responder is attempting to process the proxy server's log files but finds that they are too large to be opened by any file viewer. Which of the following is the MOST appropriate technique to open and analyze these log files?

  A. Hex editor, searching

  B. tcpdump, indexing

  C. PE Explorer, indexing

  D. Notepad, searching

  Correct Answer: A

  Reference: https://superuser.com/questions/45142/hex-editor-for-large-files-in-linux