CertNexus CertNexus Certification CFR-310 Questions & Answers

• Question 71:

  A user receives an email about an unfamiliar bank transaction, which includes a link. When clicked, the link redirects the user to a web page that looks exactly like their bank's website and asks them to log in with their username and password. Which type of attack is this?

  A. Whaling

  B. Smishing

  C. Vishing

  D. Phishing

  Correct Answer: D

  Reference: https://www.phishing.org/what-is-phishing

• Question 72:

  A suspicious script was found on a sensitive research system. Subsequent analysis determined that proprietary data would have been deleted from both the local server and backup media immediately following a specific administrator's removal from an employee list that is refreshed each evening. Which of the following BEST describes this scenario?

  A. Backdoor

  B. Rootkit

  C. Time bomb

  D. Logic bomb

  Correct Answer: A

• Question 73:

  Nmap is a tool most commonly used to:

  A. Map a route for war-driving

  B. Determine who is logged onto a host

  C. Perform network and port scanning

  D. Scan web applications

  Correct Answer: C

  Reference: https://www.networkworld.com/article/3296740/what-is-nmap-why-you-need-this-networkmapper.html

• Question 74:

  During a malware-driven distributed denial of service attack, a security researcher found excessive requests to a name server referring to the same domain name and host name encoded in hexadecimal. The malware author used which type of command and control?

  A. Internet Relay Chat (IRC)

  B. Dnscat2

  C. Custom channel

  D. File Transfer Protocol (FTP)

  Correct Answer: D

  Reference: https://www.csoonline.com/article/3276660/what-is-shodan-the-search-engine-for-everythingon-the-internet.html

• Question 75:

  In which of the following attack phases would an attacker use Shodan?

  A. Scanning

  B. Reconnaissance

  C. Gaining access

  D. Persistence

  Correct Answer: A

  Reference: https://books.google.com.pk/books?id=3bzPDwAAQBAJandpg=PA41andlpg=PA41anddq=attack +phases+would+an+attacker+use +Shodanandsource=blandots=phUbfR8BOYandsig=ACfU3U1sg5J67s_sL_Ixpr3OiqdCIraKUwandhl=enandsa=Xandved =2ahUKEwjazaKCssXpAhUC4YUKHcJ5CVwQ6AEwAXoECBMQAQ#v=onepageandq=attack%20phases% 20would%20an%20attacker %20use%20Shodanandf=false

• Question 76:

  Malicious code designed to execute in concurrence with a particular event is BEST defined as which of the following?

  A. Logic bomb

  B. Rootkit

  C. Trojan

  D. Backdoor

  Correct Answer: A

  Reference: https://searchsecurity.techtarget.com/definition/Malware-Glossary

• Question 77:

  Which of the following types of attackers would be MOST likely to use multiple zero-day exploits executed against high-value, well-defended targets for the purposes of espionage and sabotage?

  A. Cybercriminals

  B. Hacktivists

  C. State-sponsored hackers

  D. Cyberterrorist

  Correct Answer: C

• Question 78:

  While performing routing maintenance on a Windows Server, a technician notices several unapproved Windows Updates and that remote access software has been installed. The technician suspects that a malicious actor has gained access to the system. Which of the following steps in the attack process does this activity indicate?

  A. Expanding access

  B. Covering tracks

  C. Scanning

  D. Persistence

  Correct Answer: A

• Question 79:

  A security investigator has detected an unauthorized insider reviewing files containing company secrets. Which of the following commands could the investigator use to determine which files have been opened by this user?

  A. ls

  B. lsof

  C. ps

  D. netstat

  Correct Answer: B

  Reference: https://books.google.com.pk/books?id=sxr50IxP27ACandpg=PA49andlpg=PA49anddq=linux +commands+could+the+investigator+use+to+determine+which+files+have+been+opened+by+this +userandsource=blandots=RUG5bOAhGEandsig=ACfU3U3qv3h4lGh1GQP6mdNLy1RZHSPDgandhl=enandsa=Xandved=2ahUKEwiNpPeambbpAhVmx4UKHVt5CeIQ6AEwAHoECBMQAQ#v=onepage andq=linux%20commands%20could%20the% 20investigator%20use%20to%20determine%20which%20files %20have%20been%20opened%20by%20this%20userandf=false

• Question 80:

  An administrator believes that a system on VLAN 12 is Address Resolution Protocol (ARP) poisoning clients on the network. The administrator attaches a system to VLAN 12 and uses Wireshark to capture traffic. After reviewing the capture file, the administrator finds no evidence of ARP poisoning. Which of the following actions should the administrator take next?

  A. Clear the ARP cache on their system.

  B. Enable port mirroring on the switch.

  C. Filter Wireshark to only show ARP traffic.

  D. Configure the network adapter to promiscuous mode.

  Correct Answer: D

  Reference: https://www.tutorialspoint.com/ethical_hacking/ethical_hacking_arp_poisoning.htm