Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
CertNexus
CyberSec First Responder (CFR)
CFR-410
CyberSec First Responder (CFR) Exam Questions and Answers

Pass the CertNexus CyberSec First Responder (CFR) CFR-410 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam CFR-410 Premium Access

View all detail and faqs for the CFR-410 exam

Go to Exam

754 Students Passed

91% Average Score

92% Same Questions

Viewing page 2 out of 6 pages

Viewing questions 11-20 out of questions

Questions # 11:

The incident response team has completed root cause analysis for an incident. Which of the following actions should be taken in the next phase of the incident response process? (Choose two.)

Options:

Providing a briefing to management

Updating policies and procedures

Training staff for future incidents

Investigating responsible staff

Drafting a recovery plan for the incident

Answer

B, E

Questions # 12:

A user receives an email about an unfamiliar bank transaction, which includes a link. When clicked, the link redirects the user to a web page that looks exactly like their bank’s website and asks them to log in with their username and password. Which type of attack is this?

Options:

Whaling

Smishing

Vishing

Phishing

Answer

Explanation

[Reference: https://www.phishing.org/what-is-phishing, ]

Questions # 13:

An administrator believes that a system on VLAN 12 is Address Resolution Protocol (ARP) poisoning clients on the network. The administrator attaches a system to VLAN 12 and uses Wireshark to capture traffic. After

reviewing the capture file, the administrator finds no evidence of ARP poisoning. Which of the following actions should the administrator take next?

Options:

Clear the ARP cache on their system.

Enable port mirroring on the switch.

Filter Wireshark to only show ARP traffic.

Configure the network adapter to promiscuous mode.

Answer

Explanation

[Reference: https://www.tutorialspoint.com/ethical_hacking/ethical_hacking_arp_poisoning.htm, ]

Questions # 14:

According to SANS, when should an incident retrospective be performed?

Options:

After law enforcement has identified the perpetrators of the attack.

Within six months following the end of the incident.

No later than two weeks from the end of the incident.

Immediately concluding eradication of the root cause

Answer

Explanation

According to SANS, an incident retrospective should be performed no later than two weeks from the end of the incident. This allows the team to review the response, identify lessons learned, and improve future incident handling while the details are still fresh.

Questions # 15:

The statement of applicability (SOA) document forms a fundamental part of which framework?

Options:

Generally Accepted Privacy Principles (GAPP)

HIPAA

NIST Privacy Framework

ISO/IEC 27000 series

Answer

Explanation

The Statement of Applicability (SOA) document is a fundamental part of the ISO/IEC 27000 series, specifically within the context of ISO/IEC 27001. It outlines the security controls that are relevant and applicable to the organization’s information security management system (ISMS), and it helps to demonstrate how the organization is addressing the information security risks identified.

Questions # 16:

A security operations center (SOC) analyst observed an unusually high number of login failures on a particular database server. The analyst wants to gather supporting evidence before escalating the observation to management. Which of the following expressions will provide login failure data for 11/24/2015?

Options:

grep 20151124 security_log | grep –c “login failure”

grep 20150124 security_log | grep “login_failure”

grep 20151124 security_log | grep “login”

grep 20151124 security_log | grep –c “login”

Answer

Questions # 17:

A security administrator is investigating a compromised host. Which of the following commands could the investigator use to display executing processes in real time?

Options:

top

nice

pstree

Answer

Explanation

[Reference: https://www.cyberciti.biz/faq/show-all-running-processes-in-linux/, ]

Questions # 18:

What is the definition of a security breach?

Options:

An event or series of correlated events that indicate a potential violation of some control or policy.

Unauthorized access that violates the authentication, authorization, and accounting of an information asset through intentional access, destruction, or manipulation of an information asset.

An event or series of uncorrelated events that indicate a potential violation of some control or policy has occurred.

Unauthorized access that violates the confidentiality, integrity, or availability of an information asset in the form of unintentional access, destruction, or manipulation of an information asset.

Answer

Explanation

A security breach refers to unauthorized access that compromises the security of an information asset, violating controls such as authentication, authorization, or accounting. This breach often involves intentional actions like accessing, destroying, or manipulating the asset without proper authorization.

Questions # 19:

An organization recently suffered a data breach involving a server that had Transmission Control Protocol (TCP) port 1433 inadvertently exposed to the Internet. Which of the following services was vulnerable?

Options:

Internet Message Access Protocol (IMAP)

Network Basic Input/Output System (NetBIOS)

Database

Network Time Protocol (NTP)

Answer

Explanation

[Reference: http://www.princeton.edu/~rblee/ELE572Papers/Fall04Readings/ DDoSSurveyPaper_20030516_Final.pdf (9), , ]

Questions # 20:

Which two options represent the most basic methods for designing a DMZ network firewall? (Choose two.)

Options:

Software firewall

Single firewall

Triple firewall

Dual firewall

Answer

B, D

Explanation

Single firewall: A single firewall is the simplest method for designing a DMZ network, where a firewall is placed between the internal network and the external network (internet), controlling traffic to and from the DMZ.

Dual firewall: A dual firewall setup uses two firewalls, one between the internal network and the DMZ, and the other between the DMZ and the external network. This adds an extra layer of security.

Viewing page 2 out of 6 pages

Viewing questions 11-20 out of questions