CertNexus CFR-410 Online Practice Questions and Exam Preparation

CertNexus CFR-410 Online Questions & Answers

• Question 31:

  Which of the following could be useful to an organization that wants to test its incident response procedures without risking any system downtime?

  A. Blue team exercise
  B. Business continuity exercise
  C. Tabletop exercise
  D. Red team exercise
  B. Business continuity exercise

• Question 32:

  A suspicious script was found on a sensitive research system. Subsequent analysis determined that proprietary data would have been deleted from both the local server and backup media immediately following a specific administrator's removal from an employee list that is refreshed each evening. Which of the following BEST describes this scenario?

  A. Backdoor
  B. Rootkit
  C. Time bomb
  D. Login bomb
  A. Backdoor

• Question 33:

  A web server is under a denial of service (DoS) attack. The administrator reviews logs and creates an access control list (ACL) to stop the attack. Which of the following technologies could perform these steps automatically in the future?

  A. Intrusion prevention system (IPS)
  B. Intrusion detection system (IDS)
  C. Blacklisting
  D. Whitelisting
  B. Intrusion detection system (IDS)

• Question 34:

  When performing an investigation, a security analyst needs to extract information from text files in a Windows operating system. Which of the following commands should the security analyst use?

  A. findstr
  B. grep
  C. awk
  D. sigverif
  C. awk

• Question 35:

  Which of the following is a method of reconnaissance in which a ping is sent to a target with the expectation of receiving a response?

  A. Active scanning
  B. Passive scanning
  C. Network enumeration
  D. Application enumeration
  C. Network enumeration

• Question 36:

  Senior management has stated that antivirus software must be installed on all employee workstations. Which of the following does this statement BEST describe?

  A. Guideline
  B. Procedure
  C. Policy
  D. Standard
  C. Policy

• Question 37:

  To minimize vulnerability, which steps should an organization take before deploying a new Internet of Things (IoT) device? (Choose two.)

  A. Changing the default password
  B. Updating the device firmware
  C. Setting up new users
  D. Disabling IPv6
  E. Enabling the firewall
  B. Updating the device firmware
  E. Enabling the firewall

• Question 38:

  An organization recently suffered a breach due to a human resources administrator emailing employee names and Social Security numbers to a distribution list. Which of the following tools would help mitigate this risk from recurring?

  A. Data loss prevention (DLP)
  B. Firewall
  C. Web proxy
  D. File integrity monitoring
  A. Data loss prevention (DLP)

• Question 39:

  According to company policy, all accounts with administrator privileges should have suffix _ja. While reviewing Windows workstation configurations, a security administrator discovers an account without the suffix in the administrator's group. Which of the following actions should the security administrator take?

  A. Review the system log on the affected workstation.
  B. Review the security log on a domain controller.
  C. Review the system log on a domain controller.
  D. Review the security log on the affected workstation.
  B. Review the security log on a domain controller.

• Question 40:

  An incident handler is assigned to initiate an incident response for a complex network that has been affected by malware. Which of the following actions should be taken FIRST?

  A. Make an incident response plan.
  B. Prepare incident response tools.
  C. Isolate devices from the network.
  D. Capture network traffic for analysis.
  D. Capture network traffic for analysis.