[Jan-2022] CFR-310 Pre-Exam Practice Tests | Exam Questions and Answers for CertNexus Certification Study Guide
CertNexus CyberSec First Responder (CFR) Certification Sample Questions
CertNexus CFR-310 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION 59
As part of an organization's regular maintenance activities, a security engineer visits the Internet Storm Center advisory page to obtain the latest list of blacklisted host/network addresses. The security engineer does this to perform which of the following activities?
- A. Update the latest proxy access list
- B. Update access control list (ACL) rules for network devices
- C. Monitor the organization's network for suspicious traffic
- D. Monitor the organization's sensitive databases
Answer: B
NEW QUESTION 60
Tcpdump is a tool that can be used to detect which of the following indicators of compromise?
- A. Unknown open ports
- B. Unusual network traffic
- C. Unknown use of protocols
- D. Poor network performance
Answer: B
Explanation:
Explanation/Reference: https://books.google.com.pk/books?
id=b7swDwAAQBAJ&pg=PA122&lpg=PA122&dq=Tcpdump+is+a+tool+that+can+be+used+to+detect
+which+of+the+following+indicators+of
+compromise&source=bl&ots=RxkWHHpNC4&sig=ACfU3U2L48OSw8R8HdLy2ytAuYsRDi9Hmg&hl=en&s a=X&ved=2ahUKEwi44PjnybbpAhVNzIUKHSloCJgQ6AEwAHoECBMQAQ#v=onepage&q=Tcpdump%20is
%20a%20tool%20that%20can%20be%20used%20to%20detect%20which%20of%20the%20following%
20indicators%20of%20compromise&f=false
NEW QUESTION 61
Recently, a cybersecurity research lab discovered that there is a hacking group focused on hacking into the computers of financial executives in Company A to sell the exfiltrated information to Company
B. Which of the following threat motives does this MOST likely represent?
- A. Association/affiliation
- B. Desire for financial gain
- C. Desire for power
- D. Reputation/recognition
Answer: B
NEW QUESTION 62
Which of the following characteristics of a web proxy strengthens cybersecurity? (Choose two.)
- A. Increases browsing speed
- B. Limits direct connection to Internet
- C. Decreases wide area network (WAN) traffic
- D. Caches frequently-visited websites
- E. Filters unwanted content
Answer: A,D
NEW QUESTION 63
During a malware-driven distributed denial of service attack, a security researcher found excessive requests to a name server referring to the same domain name and host name encoded in hexadecimal. The malware author used which type of command and control?
- A. Custom channel
- B. Internet Relay Chat (IRC)
- C. Dnscat2
- D. File Transfer Protocol (FTP)
Answer: D
NEW QUESTION 64
The Key Reinstallation Attack (KRACK) vulnerability is specific to which types of devices? (Choose two.)
- A. Hub
- B. Switch
- C. Firewall
- D. Access point
- E. Wireless router
Answer: A,E
Explanation:
Explanation/Reference: https://www.kaspersky.com/blog/krackattack/19798/
NEW QUESTION 65
A security investigator has detected an unauthorized insider reviewing files containing company secrets.
Which of the following commands could the investigator use to determine which files have been opened by this user?
- A. ps
- B. ls
- C. netstat
- D. lsof
Answer: D
Explanation:
Explanation/Reference: https://books.google.com.pk/books?id=sxr50IxP27AC&pg=PA49&lpg=PA49&dq=linux
+commands+could+the+investigator+use+to+determine+which+files+have+been+opened+by+this
+user&source=bl&ots=RUG5bOAhGE&sig=ACfU3U3qv3h4lGh1GQP6mdNLy1RZH-
SPDg&hl=en&sa=X&ved=2ahUKEwiNpPeambbpAhVmx4UKHVt5CeIQ6AEwAHoECBMQAQ#v=onepage& q=linux%20commands%20could%20the%20investigator%20use%20to%20determine%20which%20files%
20have%20been%20opened%20by%20this%20user&f=false
NEW QUESTION 66
It was recently discovered that many of an organization's servers were running unauthorized cryptocurrency mining software. Which of the following assets were being targeted in this attack? (Choose two.)
- A. Computing resources
- B. Network resources
- C. Financial resources
- D. Disk resources
- E. Power resources
Answer: B,E
NEW QUESTION 67
An attacker intercepts a hash and compares it to pre-computed hashes to crack a password. Which of the following methods has been used?
- A. Password sniffing
- B. Brute force attack
- C. Rainbow tables
- D. Dictionary attack
Answer: C
NEW QUESTION 68
A security operations center (SOC) analyst observed an unusually high number of login failures on a particular database server. The analyst wants to gather supporting evidence before escalating the observation to management. Which of the following expressions will provide login failure data for 11/24/2015?
- A. grep 20151124 security_log | grep -c "login"
- B. grep 20150124 security_log | grep "login_failure"
- C. grep 20151124 security_log | grep -c "login failure"
- D. grep 20151124 security_log | grep "login"
Answer: D
NEW QUESTION 69
In which of the following attack phases would an attacker use Shodan?
- A. Persistence
- B. Scanning
- C. Gaining access
- D. Reconnaissance
Answer: B
NEW QUESTION 70
Nmap is a tool most commonly used to:
- A. Determine who is logged onto a host
- B. Map a route for war-driving
- C. Perform network and port scanning
- D. Scan web applications
Answer: C
Explanation:
Explanation/Reference: https://www.networkworld.com/article/3296740/what-is-nmap-why-you-need-this-network- mapper.html
NEW QUESTION 71
Which of the following attacks involves sending a large amount of spoofed User Datagram Protocol (UDP) traffic to a router's broadcast address within a network?
- A. Smurf attack
- B. Land attack
- C. Teardrop attack
- D. Fraggle attack
Answer: A
NEW QUESTION 72
During a log review, an incident responder is attempting to process the proxy server's log files but finds that they are too large to be opened by any file viewer. Which of the following is the MOST appropriate technique to open and analyze these log files?
- A. Notepad, searching
- B. Hex editor, searching
- C. PE Explorer, indexing
- D. tcpdump, indexing
Answer: B
Explanation:
Explanation/Reference: https://superuser.com/questions/45142/hex-editor-for-large-files-in-linux
NEW QUESTION 73
A security analyst is required to collect detailed network traffic on a virtual machine. Which of the following tools could the analyst use?
- A. nbtstat
- B. netstat
- C. WinDump
- D. fport
Answer: B
NEW QUESTION 74
Which of the following is a method of reconnaissance in which a ping is sent to a target with the expectation of receiving a response?
- A. Application enumeration
- B. Active scanning
- C. Passive scanning
- D. Network enumeration
Answer: D
NEW QUESTION 75
Detailed step-by-step instructions to follow during a security incident are considered:
- A. Standards
- B. Procedures
- C. Guidelines
- D. Policies
Answer: B
NEW QUESTION 76
Which of the following are well-known methods that are used to protect evidence during the forensics process?
(Choose three.)
- A. Evidence bags
- B. Secure rooms
- C. Faraday boxes
- D. Lock box
- E. Security envelope
- F. Caution tape
Answer: A,E,F
NEW QUESTION 77
Which of the following is the GREATEST risk of having security information and event management (SIEM) collect computer names with older log entries?
- A. Domain Name System (DNS) records may have changed since the log was created.
- B. The computer name may not be admissible evidence in court.
- C. There may be field name duplication when combining log files.
- D. There may be duplicate computer names on the network.
Answer: C
NEW QUESTION 78
Which of the following is the FIRST step taken to maintain the chain of custody in a forensic investigation?
- A. Conducting preliminary interviews
- B. Security and evaluating the electronic crime scene.
- C. Transporting the evidence to the forensics lab
- D. Packaging the electronic device
Answer: D
NEW QUESTION 79
Network infrastructure has been scanned and the identified issues have been remediated. What is the next step in the vulnerability assessment process?
- A. Generating reports
- B. Assessing exposures
- C. Conducting an audit
- D. Establishing scope
Answer: C
NEW QUESTION 80
Which of the following are common areas of vulnerabilities in a network switch? (Choose two.)
- A. Default port state
- B. Default IP address
- C. Default encryption
- D. Default protocols
- E. Default credentials
Answer: A,E
NEW QUESTION 81
A security administrator notices a process running on their local workstation called SvrsScEsdKexzCv.exe.
The unknown process is MOST likely:
- A. Malware
- B. A system process
- C. An application process
- D. A port scanner
Answer: A
NEW QUESTION 82
Which of the following could be useful to an organization that wants to test its incident response procedures without risking any system downtime?
- A. Red team exercise
- B. Tabletop exercise
- C. Blue team exercise
- D. Business continuity exercise
Answer: D
Explanation:
Explanation/Reference: https://www.gsma.com/mobilefordevelopment/wp-content/uploads/2017/11/Exercising-BC-Plans- for-Natural-Disasters-A-Quick-Guide-for-MNOs.pdf
NEW QUESTION 83
......
CertNexus Exam Practice Test To Gain Brilliante Result: https://torrentvce.pass4guide.com/CFR-310-dumps-questions.html