CertNexus CFR-410 Online Practice Questions and Exam Preparation

CertNexus CFR-410 Online Questions & Answers

• Question 1:

  Which of the following types of digital evidence is considered the MOST volatile?

  A. Data on a hard disk
  B. Temporary file space
  C. Swap file
  D. Random access memory
  D. Random access memory

• Question 2:

  During a malware-driven distributed denial of service attack, a security researcher found excessive requests to a name server referring to the same domain name and host name encoded in hexadecimal. The malware author used which type of command and control?

  A. Internet Relay Chat (IRC)
  B. Dnscat2
  C. Custom channel
  D. File Transfer Protocol (FTP)
  D. File Transfer Protocol (FTP)

• Question 3:

  Tcpdump is a tool that can be used to detect which of the following indicators of compromise?

  A. Unusual network traffic
  B. Unknown open ports
  C. Poor network performance
  D. Unknown use of protocols
  A. Unusual network traffic

• Question 4:

  What are three benefits of security logging and monitoring? (Choos)

  A. Feeding intrusion detection systems
  B. Satisfying regulatory compliance requirements
  C. Data collection
  D. Forensic analysis and investigations
  E. Penetration testinge three.)
  B. Satisfying regulatory compliance requirements
  C. Data collection
  D. Forensic analysis and investigations

• Question 5:

  Which two options represent the most basic methods for designing a DMZ network firewall? (Choose two.)

  A. Software firewall
  B. Single firewall
  C. Triple firewall
  D. Dual firewall
  B. Single firewall
  D. Dual firewall

• Question 6:

  Which term best describes an asset's susceptibility to damage or loss due to a threat?

  A. Exposure
  B. Attack
  C. Breach
  D. Threat
  A. Exposure

• Question 7:

  A forensic analyst has been tasked with analyzing disk images with file extensions such as .001, .002, etc. Which of the following disk imaging tools was MOST LIKELY used to create these image files?

  A. Encase
  B. ExifTool
  C. SIFT
  D. FTK
  E. dd
  E. dd

• Question 8:

  After a hacker obtained a shell on a Linux box, the hacker then sends the exfiltrated data via Domain Name System (DNS). This is an example of which type of data exfiltration?

  A. Covert channels
  B. File sharing services
  C. Steganography
  D. Rogue service
  A. Covert channels

• Question 9:

  Which of the following are core functions of SIEM solutions?

  A. Alerts of potential attacks, forensic investigations, and incident detection.
  B. Forensic investigations, threat modeling, and big data analysis.
  C. Malware analysis, forensic investigations, and incident detection.
  D. Static malware analysis, dynamic malware analysis, and incident detection.
  A. Alerts of potential attacks, forensic investigations, and incident detection.

• Question 10:

  An unauthorized network scan may be detected by parsing network sniffer data for:

  A. IP traffic from a single IP address to multiple IP addresses.
  B. IP traffic from a single IP address to a single IP address.
  C. IP traffic from multiple IP addresses to a single IP address.
  D. IP traffic from multiple IP addresses to other networks.
  C. IP traffic from multiple IP addresses to a single IP address.