CFR-410 CyberSec First Responder (CFR) Exam Questions and Answers
A cybersecurity expert assigned to be the IT manager of a middle-sized company discovers that there is little endpoint security implementation on the company’s systems. Which of the following could be included in an endpoint security solution? (Choose two.)
Which of the following represents a front-end security capability that addresses cyber resiliency?
A digital forensics investigation requires analysis of a compromised system ' s physical memory. Which of the following tools should the forensics analyst use to complete this task?
During a security investigation, a suspicious Linux laptop is found in the server room. The laptop is processing information and indicating network activity. The investigator is preparing to launch an investigation to
determine what is happening with this laptop. Which of the following is the MOST appropriate set of Linux commands that should be executed to conduct the investigation?
An organization that recently suffered a ransomware attack found that its backups were faulty. Which of the following steps could BEST ensure reliable backups in the future?
Which of the following attack vectors capitalizes on a previously undisclosed issue with a software application?
While planning a vulnerability assessment on a computer network, which of the following is essential? (Choose two.)
A security administrator is investigating a compromised host. Which of the following commands could the investigator use to display executing processes in real time?
Which of the following is BEST suited to prevent piggybacking into a sensitive or otherwise restricted area of a facility?
An incident responder has collected network capture logs in a text file, separated by five or more data fields.
Which of the following is the BEST command to use if the responder would like to print the file (to terminal/ screen) in numerical order?
ABC Company uses technical compliance tests to verify that its IT systems are configured according to organizational information security policies, standards, and guidelines. Which two tools and controls can ABC Company use to verify that its IT systems are configured accordingly? (Choose two.)
Which of the following is a cybersecurity solution for insider threats to strengthen information protection?
When reviewing log files from a recent incident, the response team discovers that most of the network-based indicators are IP-based. It would be helpful to the response team if they could resolve those IP-based indicators to hostnames. Which of the following is BEST suited for this task?
A company that maintains a public city infrastructure was breached and information about future city projects was leaked. After the post-incident phase of the process has been completed, which of the following would be
PRIMARY focus of the incident response team?
Which of the following are part of the hardening phase of the vulnerability assessment process? (Choose two.)
The NIST framework 800-137 breaks down the concept of continuous monitoring into which system of tiers?
Which of the following attacks involves sending a large amount of spoofed User Datagram Protocol (UDP) traffic to a router’s broadcast address within a network?
Which term describes the process of collecting logs from many sources across an IT infrastructure into a single, centralized platform to be reviewed and analyzed?
A system administrator has been tasked with developing highly detailed instructions for patching managed assets using the corporate patch management solution. These instructions are an example of which of the following?
When tracing an attack to the point of origin, which of the following items is critical data to map layer 2 switching?
Which of the following could be useful to an organization that wants to test its incident response procedures without risking any system downtime?
An incident response team is concerned with verifying the integrity of security information and event
management (SIEM) events after being written to disk. Which of the following represents the BEST option for addressing this concern?
A security administrator needs to review events from different systems located worldwide. Which of the
following is MOST important to ensure that logs can be effectively correlated?
A security analyst has discovered that an application has failed to run. Which of the following is the tool MOST
likely used by the analyst for the initial discovery?
During a malware-driven distributed denial of service attack, a security researcher found excessive requests to a name server referring to the same domain name and host name encoded in hexadecimal. The malware author used which type of command and control?
An incident responder discovers that the CEO logged in from their New York City office and then logged in from a location in Beijing an hour later. The incident responder suspects that the CEO’s account has been
compromised. Which of the following anomalies MOST likely contributed to the incident responder’s suspicion?
An organization recently suffered a data breach involving a server that had Transmission Control Protocol (TCP) port 1433 inadvertently exposed to the Internet. Which of the following services was vulnerable?
Network infrastructure has been scanned and the identified issues have been remediated. What is the next step in the vulnerability assessment process?
An incident responder was asked to analyze malicious traffic. Which of the following tools would be BEST for this?
Which three disk image formats are used for evidence collection and preservation? (Choose three.)
Which three answer options are password attack methods and techniques? (Choose three.)
A government organization responsible for critical infrastructure is being attacked and files on the server been deleted. Which of the following are the most immediate communications that should be made regarding the incident? (Choose two.)
An unauthorized network scan may be detected by parsing network sniffer data for:
A security analyst is required to collect detailed network traffic on a virtual machine. Which of the following tools could the analyst use?
A web server is under a denial of service (DoS) attack. The administrator reviews logs and creates an access control list (ACL) to stop the attack. Which of the following technologies could perform these steps automatically in the future?
After imaging a disk as part of an investigation, a forensics analyst wants to hash the image using a tool that supports piecewise hashing. Which of the following tools should the analyst use?
What kind of measures and controls are implemented when employees get assigned personal, unique badges when they join the organization, and they remain valid until the employee ' s last day of work?
In a Linux operating system, what kind of information does a /var/log/daemon.log file contain?
If an organization suspects criminal activity during the response to an incident, when should they notify law enforcement authorities?
Which of the following plans helps IT security staff detect, respond to, and recover from a cyber attack?
Which of the following backup strategies will result in the shortest backup time during weekdays and use the least amount of storage space but incur the longest restore time?
Which of the following can be used as a vulnerability management and assessment tool?
A computer forensics analyst suspects that some of the pictures recovered from the suspect ' s hard drive may contain metadata pertinent to the criminal investigation. Which of the following tools is BEST suited to retrieving any available metadata?
A security analyst needs to capture network traffic from a compromised Mac host. They attempt to execute the tcpdump command using their general user account but continually receive an " Operation Not Permitted " error.
Use of which of the following commands will allow the analyst to capture traffic using tcpdump successfully?
An organization was recently hit with a ransomware attack that encrypted critical documents and files that were stored on the corporate file server.
Which of the following provides the organization with the BEST chance for recovering their data?
An automatic vulnerability scan has been performed. Which is the next step of the vulnerability assessment process?
Which three tools are used for integrity verification of files? (Choose three.)
PDF + Testing Engine
Testing Engine
PDF (Q&A)
