CertNexus CFR-410 Online Practice Questions and Exam Preparation

CertNexus CFR-410 Online Questions & Answers

• Question 21:

  A security analyst has discovered that an application has failed to run. Which of the following is the tool MOST likely used by the analyst for the initial discovery?

  A. syslog
  B. MSConfig
  C. Event Viewer
  D. Process Monitor
  C. Event Viewer

• Question 22:

  Where are log entries written for auditd in Linux?

  A. /etc/audit/audit.rules
  B. /var/log/audit/messages
  C. /var/log/audit/audit.log
  D. /var/log/audit.log
  E. /etc/audit/audit.conf
  C. /var/log/audit/audit.log

• Question 23:

  An incident response team is concerned with verifying the integrity of security information and event management (SIEM) events after being written to disk. Which of the following represents the BEST option for addressing this concern?

  A. Time synchronization
  B. Log hashing
  C. Source validation
  D. Field name consistency
  A. Time synchronization

• Question 24:

  Which approach to cybersecurity involves a series of defensive mechanisms that are layered to protect valuable data and information?

  A. Network segmentation
  B. Defense in depth
  C. Tiered security
  D. Endpoint detection and response
  B. Defense in depth

• Question 25:

  Which of the following, when exposed together, constitutes PII? (Choose two.)

  A. Full name
  B. Birth date
  C. Account balance
  D. Marital status
  E. Employment status
  A. Full name
  C. Account balance

• Question 26:

  While reviewing some audit logs, an analyst has identified consistent modifications to the sshd_config file for an organization's server. The analyst would like to investigate and compare contents of the current file with archived versions of files that are saved weekly. Which of the following tools will be MOST effective during the investigation?

  A. cat * | cut –d
  B. more * | grep
  C. diff
  D. sort *
  C. diff

• Question 27:

  During a log review, an incident responder is attempting to process the proxy server's log files but finds that they are too large to be opened by any file viewer. Which of the following is the MOST appropriate technique to open and analyze these log files?

  A. Hex editor, searching
  B. tcpdump, indexing
  C. PE Explorer, indexing
  D. Notepad, searching
  A. Hex editor, searching

• Question 28:

  Which of the following is susceptible to a cache poisoning attack?

  A. Domain Name System (DNS)
  B. Secure Shell (SSH)
  C. Hypertext Transfer Protocol Secure (HTTPS)
  D. Hypertext Transfer Protocol (HTTP)
  A. Domain Name System (DNS)

• Question 29:

  When attempting to determine which system or user is generating excessive web traffic, analysis of which of the following would provide the BEST results?

  A. Browser logs
  B. HTTP logs
  C. System logs
  D. Proxy logs
  D. Proxy logs

• Question 30:

  Which three of the following are included in encryption architecture? (Choose three.)

  A. Certificate
  B. Encryption keys
  C. Encryption engine
  D. Database encryption
  E. Data
  A. Certificate
  B. Encryption keys
  C. Encryption engine