Passing CertNexus CFR-410 Exam Using 2023 Practice Tests
CFR-410 Study Guide Brilliant CFR-410 Exam Dumps PDF
NEW QUESTION 18
Which common source of vulnerability should be addressed to BEST mitigate against URL redirection attacks?
- A. Configuration files
- B. Network infrastructure
- C. Application
- D. Users
Answer: C
NEW QUESTION 19
An incident response team is concerned with verifying the integrity of security information and event management (SIEM) events after being written to disk. Which of the following represents the BEST option for addressing this concern?
- A. Source validation
- B. Field name consistency
- C. Time synchronization
- D. Log hashing
Answer: C
NEW QUESTION 20
According to Payment Card Industry Data Security Standard (PCI DSS) compliance requirements, an organization must retain logs for what length of time?
- A. 3 months
- B. 5 years
- C. 1 year
- D. 6 months
Answer: C
NEW QUESTION 21
An unauthorized network scan may be detected by parsing network sniffer data for:
- A. IP traffic from a single IP address to multiple IP addresses.
- B. IP traffic from a single IP address to a single IP address.
- C. IP traffic from multiple IP addresses to a single IP address.
- D. IP traffic from multiple IP addresses to other networks.
Answer: C
NEW QUESTION 22
Various logs are collected for a data leakage case to make a forensic analysis. Which of the following are MOST important for log integrity? (Choose two.)
- A. Log path
- B. Hash value
- C. Modified date/time
- D. Log type
- E. Time stamp
Answer: B,E
NEW QUESTION 23
While reviewing some audit logs, an analyst has identified consistent modifications to the sshd_config file for an organization's server. The analyst would like to investigate and compare contents of the current file with archived versions of files that are saved weekly. Which of the following tools will be MOST effective during the investigation?
- A. diff
- B. sort *
- C. more * | grep
- D. cat * | cut -d ',' -f 2,5,7
Answer: A
NEW QUESTION 24
A company help desk is flooded with calls regarding systems experiencing slow performance and certain Internet sites taking a long time to load or not loading at all. The security operations center (SOC) analysts who receive these calls take the following actions:
- Running antivirus scans on the affected user machines
- Checking department membership of affected users
- Checking the host-based intrusion prevention system (HIPS) console for affected user machine alerts
- Checking network monitoring tools for anomalous activities
Which of the following phases of the incident response process match the actions taken?
- A. Containment
- B. Identification
- C. Preparation
- D. Recovery
Answer: B
NEW QUESTION 25
Which of the following is susceptible to a cache poisoning attack?
- A. Domain Name System (DNS)
- B. Hypertext Transfer Protocol (HTTP)
- C. Secure Shell (SSH)
- D. Hypertext Transfer Protocol Secure (HTTPS)
Answer: A
NEW QUESTION 26
A security analyst has discovered that an application has failed to run. Which of the following is the tool MOST likely used by the analyst for the initial discovery?
- A. syslog
- B. MSConfig
- C. Process Monitor
- D. Event Viewer
Answer: D
NEW QUESTION 27
If a hacker is attempting to alter or delete system audit logs, in which of the following attack phases is the hacker involved?
- A. Performing reconnaissance
- B. Expanding access
- C. Gaining persistence
- D. Covering tracks
Answer: D
NEW QUESTION 28
To minimize vulnerability, which steps should an organization take before deploying a new Internet of Things (IoT) device? (Choose two.)
- A. Disabling IPv6
- B. Setting up new users
- C. Enabling the firewall
- D. Changing the default password
- E. Updating the device firmware
Answer: C,E
NEW QUESTION 29
A network security analyst has noticed a flood of Simple Mail Transfer Protocol (SMTP) traffic to internal clients. SMTP traffic should only be allowed to email servers. Which of the following commands would stop this attack? (Choose two.)
- A. iptables -A INPUT -p tcp -sport 25 -d x.x.x.x -j ACCEPT
- B. iptables -A FORWARD -p tcp -dport 6881:6889 -j DROP
- C. iptables -A INPUT -p tcp -dport 25 -d x.x.x.x -j ACCEPT
- D. iptables -A INPUT -p tcp -dport 25 -j DROP
- E. iptables -A INPUT -p tcp -destination-port 21 -j DROP
Answer: C,D
NEW QUESTION 30
Which of the following data sources could provide indication of a system compromise involving the exfiltration of data to an unauthorized destination?
- A. SSL logs
- B. DNS logs
- C. IPS logs
- D. SQL logs
Answer: C
NEW QUESTION 31
An automatic vulnerability scan has been performed. Which is the next step of the vulnerability assessment process?
- A. Generating reports
- B. Documenting exceptions
- C. Hardening the infrastructure
- D. Assessing identified exposures
Answer: A
NEW QUESTION 32
A security administrator needs to review events from different systems located worldwide. Which of the following is MOST important to ensure that logs can be effectively correlated?
- A. Logs should be synchronized to a common, predefined time source.
- B. Logs should contain the username of the user performing the action.
- C. Logs should include the physical location of the action performed.
- D. Logs should be synchronized to their local time zone.
Answer: D
Explanation:
Section: (none)
Explanation
NEW QUESTION 33
A user receives an email about an unfamiliar bank transaction, which includes a link. When clicked, the link redirects the user to a web page that looks exactly like their bank's website and asks them to log in with their username and password. Which type of attack is this?
- A. Phishing
- B. Vishing
- C. Smishing
- D. Whaling
Answer: A
NEW QUESTION 34
The Key Reinstallation Attack (KRACK) vulnerability is specific to which types of devices? (Choose two.)
- A. Firewall
- B. Access point
- C. Switch
- D. Wireless router
- E. Hub
Answer: D,E
NEW QUESTION 35
Which of the following describes United States federal government cybersecurity policies and guidelines?
- A. GDPR
- B. NIST
- C. ANSI
- D. NERC
Answer: B
NEW QUESTION 36
Senior management has stated that antivirus software must be installed on all employee workstations. Which of the following does this statement BEST describe?
- A. Standard
- B. Policy
- C. Procedure
- D. Guideline
Answer: B
NEW QUESTION 37
A security analyst is required to collect detailed network traffic on a virtual machine. Which of the following tools could the analyst use?
- A. nbtstat
- B. fport
- C. WinDump
- D. netstat
Answer: D
NEW QUESTION 38
It was recently discovered that many of an organization's servers were running unauthorized cryptocurrency mining software. Which of the following assets were being targeted in this attack? (Choose two.)
- A. Disk resources
- B. Financial resources
- C. Power resources
- D. Network resources
- E. Computing resources
Answer: C,D
NEW QUESTION 39
......
Free CFR-410 Test Questions Real Practice Test Questions: https://www.free4torrent.com/CFR-410-braindumps-torrent.html
View CFR-410 Exam Question Dumps With Latest Demo: https://drive.google.com/open?id=1jOLGUFazSTdVtvXdDYB2e5EK6KGw_X4u