CertNexus CFR-410 Online Practice Questions and Exam Preparation

CertNexus CFR-410 Online Questions & Answers

• Question 171:

  The incident response team has completed root cause analysis for an incident. Which of the following actions should be taken in the next phase of the incident response process? (Choose two.)

  A. Providing a briefing to management
  B. Updating policies and procedures
  C. Training staff for future incidents
  D. Investigating responsible staff
  E. Drafting a recovery plan for the incident
  B. Updating policies and procedures
  E. Drafting a recovery plan for the incident

• Question 172:

  Which of the following attacks involves sending a large amount of spoofed User Datagram Protocol (UDP) traffic to a router's broadcast address within a network?

  A. Land attack
  B. Fraggle attack
  C. Smurf attack
  D. Teardrop attack
  C. Smurf attack

• Question 173:

  While performing routing maintenance on a Windows Server, a technician notices several unapproved Windows Updates and that remote access software has been installed. The technician suspects that a malicious actor has gained access to the system. Which of the following steps in the attack process does this activity indicate?

  A. Expanding access
  B. Covering tracks
  C. Scanning
  D. Persistence
  A. Expanding access

• Question 174:

  A company that maintains a public city infrastructure was breached and information about future city projects was leaked. After the post-incident phase of the process has been completed, which of the following would be PRIMARY focus of the incident response team?

  A. Restore service and eliminate the business impact.
  B. Determine effective policy changes.
  C. Inform the company board about the incident.
  D. Contact the city police for official investigation.
  B. Determine effective policy changes.

• Question 175:

  What is the primary purpose of the "information security incident triage and processing function" in the (CSIRT) Computer Security Incident Response Team Services Framework?

  A. To analyze and gain an understanding of a confirmed information security incident.
  B. To initially review, categorize, prioritize, and process a reported information security incident.
  C. To receive and process reports of potential information security incidents from constituents, Information Security Event Management services, or third parties.
  D. To accept or receive information about an information security incident, as reported from constituents or third parties.
  B. To initially review, categorize, prioritize, and process a reported information security incident.

• Question 176:

  Which of the following should normally be blocked through a firewall?

  A. SNMP
  B. SMTP
  C. NTP
  D. POP3
  A. SNMP

• Question 177:

  It was recently discovered that many of an organization's servers were running unauthorized cryptocurrency mining software. Which of the following assets were being targeted in this attack? (Choose two.)

  A. Power resources
  B. Network resources
  C. Disk resources
  D. Computing resources
  E. Financial resources
  A. Power resources
  B. Network resources

• Question 178:

  During the forensic analysis of a compromised computer image, the investigator found that critical files are missing, caches have been cleared, and the history and event log files are empty. According to this scenario, which of the following techniques is the suspect using?

  A. System hardening techniques
  B. System optimization techniques
  C. Defragmentation techniques
  D. Anti-forensic techniques
  D. Anti-forensic techniques

• Question 179:

  A user receives an email about an unfamiliar bank transaction, which includes a link. When clicked, the link redirects the user to a web page that looks exactly like their bank's website and asks them to log in with their username and password. Which type of attack is this?

  A. Whaling
  B. Smishing
  C. Vishing
  D. Phishing
  D. Phishing

• Question 180:

  DRAG DROP

  What is the correct order of the DFIR phases?

  Select and Place: