CertNexus CertNexus Certification CFR-310 Questions & Answers

• Question 51:

  An incident response team is concerned with verifying the integrity of security information and event management (SIEM) events after being written to disk. Which of the following represents the BEST option for addressing this concern?

  A. Time synchronization

  B. Log hashing

  C. Source validation

  D. Field name consistency

  Correct Answer: A

  Reference: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf

• Question 52:

  During the forensic analysis of a compromised computer image, the investigator found that critical files are missing, caches have been cleared, and the history and event log files are empty. According to this scenario, which of the following techniques is the suspect using?

  A. System hardening techniques

  B. System optimization techniques

  C. Defragmentation techniques

  D. Anti-forensic techniques

  Correct Answer: D

• Question 53:

  A security engineer is setting up security information and event management (SIEM). Which of the following log sources should the engineer include that will contain indicators of a possible web server compromise? (Choose two.)

  A. NetFlow logs

  B. Web server logs

  C. Domain controller logs

  D. Proxy logs

  E. FTP logs

  Correct Answer: BC

  Reference: https://www.techrepublic.com/blog/data-center/top-three-indicators-of-compromised-webservers/

• Question 54:

  According to company policy, all accounts with administrator privileges should have suffix _ja. While

  reviewing Windows workstation configurations, a security administrator discovers an account without the

  suffix in the administrator's group.

  Which of the following actions should the security administrator take?

  A. Review the system log on the affected workstation.

  B. Review the security log on a domain controller.

  C. Review the system log on a domain controller.

  D. Review the security log on the affected workstation.

  Correct Answer: B

• Question 55:

  After a hacker obtained a shell on a Linux box, the hacker then sends the exfiltrated data via Domain Name System (DNS). This is an example of which type of data exfiltration?

  A. Covert channels

  B. File sharing services

  C. Steganography

  D. Rogue service

  Correct Answer: A

• Question 56:

  Which of the following methods are used by attackers to find new ransomware victims? (Choose two.)

  A. Web crawling

  B. Distributed denial of service (DDoS) attack

  C. Password guessing

  D. Phishing

  E. Brute force attack

  Correct Answer: DE

  Reference: https://www.itproportal.com/features/the-four-most-popular-methods-hackers-use-to-spreadransomware/

• Question 57:

  It was recently discovered that many of an organization's servers were running unauthorized cryptocurrency mining software. Which of the following assets were being targeted in this attack? (Choose two.)

  A. Power resources

  B. Network resources

  C. Disk resources

  D. Computing resources

  E. Financial resources

  Correct Answer: AB

  Reference: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/security-101the-impact-of-cryptocurrency-mining-malware

• Question 58:

  Recently, a cybersecurity research lab discovered that there is a hacking group focused on hacking into the computers of financial executives in Company A to sell the exfiltrated information to Company B. Which of the following threat motives does this MOST likely represent?

  A. Desire for power

  B. Association/affiliation

  C. Reputation/recognition

  D. Desire for financial gain

  Correct Answer: D

• Question 59:

  A common formula used to calculate risk is: _____________ + Threats + Vulnerabilities = Risk. Which of the following represents the missing factor in this formula?

  A. Exploits

  B. Security

  C. Asset

  D. Probability

  Correct Answer: C

  Reference: https://www.threatanalysis.com/2010/05/03/threat-vulnerability-risk-commonly-mixed-up-terms/

• Question 60:

  After successfully enumerating the target, the hacker determines that the victim is using a firewall. Which of the following techniques would allow the hacker to bypass the intrusion prevention system (IPS)?

  A. Stealth scanning

  B. Xmas scanning

  C. FINS scanning

  D. Port scanning

  Correct Answer: C

  Reference: https://nmap.org/book/firewall-subversion.html