CertNexus CFR-410 Online Practice Questions and Exam Preparation

CertNexus CFR-410 Online Questions & Answers

• Question 41:

  Windows Server 2016 log files can be found in which of the following locations?

  A. C:\Windows\System\winevt\Logs
  B. C:\Windows\winevt\System32\Logs
  C. C:\Windows\System32\winevt\Logs
  D. C:\Windows\winevt\System\Logs
  C. C:\Windows\System32\winevt\Logs

• Question 42:

  What is the definition of a security breach?

  A. An event or series of correlated events that indicate a potential violation of some control or policy.
  B. Unauthorized access that violates the authentication, authorization, and accounting of an information asset through intentional access, destruction, or manipulation of an information asset.
  C. An event or series of uncorrelated events that indicate a potential violation of some control or policy has occurred.
  D. Unauthorized access that violates the confidentiality, integrity, or availability of an information asset in the form of unintentional access, destruction, or manipulation of an information asset.
  B. Unauthorized access that violates the authentication, authorization, and accounting of an information asset through intentional access, destruction, or manipulation of an information asset.

• Question 43:

  Which of the following actions should be done by the incident response team after completing the recovery phase of the cyber incident caused by malware?

  A. Eradicate the malware.
  B. Conduct lessons learned.
  C. Isolate the malware from the system.
  D. Collect evidence for the lawsuit.
  E. Analyze the behavior of the malware.
  B. Conduct lessons learned.

• Question 44:

  A Linux system administrator found suspicious activity on host IP 192.168.10.121. This host is also establishing a connection to IP 88.143.12.123. Which of the following commands should the administrator use to capture only the traffic between the two hosts?

  A. # tcpdump -i eth0 host 88.143.12.123
  B. # tcpdump -i eth0 dst 88.143.12.123
  C. # tcpdump -i eth0 host 192.168.10.121
  D. # tcpdump -i eth0 src 88.143.12.123
  B. # tcpdump -i eth0 dst 88.143.12.123

• Question 45:

  During which phase of a vulnerability assessment would a security consultant need to document a requirement to retain a legacy device that is no longer supported and cannot be taken offline?

  A. Conducting post-assessment tasks
  B. Determining scope
  C. Identifying critical assets
  D. Performing a vulnerability scan
  C. Identifying critical assets

• Question 46:

  Which of the following data sources could provide indication of a system compromise involving the exfiltration of data to an unauthorized destination?

  A. IPS logs
  B. DNS logs
  C. SQL logs
  D. SSL logs
  A. IPS logs

• Question 47:

  Detailed step-by-step instructions to follow during a security incident are considered:

  A. Policies
  B. Guidelines
  C. Procedures
  D. Standards
  C. Procedures

• Question 48:

  What are three examples of incident response? (Choose three.)

  A. Dealing with systems that are suspected to be used to commit a crime
  B. Collecting data from computer media
  C. Dealing with systems suspected to be the victim of a crime
  D. Analyzing a system
  E. Threat Modeling
  A. Dealing with systems that are suspected to be used to commit a crime
  B. Collecting data from computer media
  C. Dealing with systems suspected to be the victim of a crime

• Question 49:

  A security analyst needs to capture network traffic from a compromised Mac host. They attempt to execute the tcpdump command using their general user account but continually receive an "Operation Not Permitted" error.

  Use of which of the following commands will allow the analyst to capture traffic using tcpdump successfully?

  A. sudo
  B. netstat
  C. chroot
  D. chmod
  E. lsof
  A. sudo

• Question 50:

  A security professional discovers a new ransomware strain that disables antivirus on the endpoint during an infection. Which location would be the BEST place for the security professional to find technical information about this malware?

  A. Threat intelligence feeds
  B. Computer emergency response team (CERT) press releases
  C. Vulnerability databases
  D. Social network sites
  A. Threat intelligence feeds