CFR-410 by CertNexus Actual Free Exam Q&As

Question 1

A security engineer is setting up security information and event management (SIEM). Which of the following log sources should the engineer include that will contain indicators of a possible web server compromise?
(Choose two.)

A. Web server logs B. FTP logs C. NetFlow logs D. Proxy logs E. Domain controller logs

Discussion 0

Correct Answer: A,E Vote an answer

Question 2

Which of the following attacks involves sending a large amount of spoofed User Datagram Protocol (UDP) traffic to a router's broadcast address within a network?

A. Smurf attack B. Fraggle attack C. Teardrop attack D. Land attack

Discussion 0

Correct Answer: A Vote an answer

Question 3

What is the definition of a security breach?

A. Unauthorized access that violates the authentication, authorization, and accounting of an information asset through intentional access, destruction, or manipulation of an information asset. B. Unauthorized access that violates the confidentiality, integrity, or availability of an information asset in the form of unintentional access, destruction, or manipulation of an information asset. C. An event or series of uncorrelated events that indicate a potential violation of some control or policy has occurred. D. An event or series of correlated events that indicate a potential violation of some control or policy.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 4

Which of the following is an essential component of a disaster recovery plan?

A. A dedicated incident response team B. Product service agreements C. Complete hardware and software inventories D. Memorandums of agreement with vendors

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 5

Which three tools are used for integrity verification of files? (Choose three.)

A. sha256sum B. md5sum C. pgp32 D. md5deep E. ent

Discussion 0

Correct Answer: A,B,D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 6

Which of the following methods are used by attackers to find new ransomware victims? (Choose two.)

A. Password guessing B. Web crawling C. Phishing D. Distributed denial of service (DDoS) attack E. Brute force attack

Discussion 0

Correct Answer: C,E Vote an answer

Question 7

Which three of the following are included in encryption architecture? (Choose three.)

A. Database encryption B. Data C. Encryption engine D. Certificate E. Encryption keys

Discussion 0

Correct Answer: C,D,E Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 8

Where are log entries written for auditd in Linux?

A. /var/log/audit/audit.log B. /var/log/audit.log C. /var/log/audit/messages D. /etc/audit/audit.conf E. /etc/audit/audit.rules

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 9

Network infrastructure has been scanned and the identified issues have been remediated. What is the next step in the vulnerability assessment process?

A. Generating reports B. Conducting an audit C. Establishing scope D. Assessing exposures

Discussion 0

Correct Answer: B Vote an answer

Question 10

According to company policy, all accounts with administrator privileges should have suffix _ja. While reviewing Windows workstation configurations, a security administrator discovers an account without the suffix in the administrator's group. Which of the following actions should the security administrator take?

A. Review the system log on the affected workstation. B. Review the security log on a domain controller. C. Review the security log on the affected workstation. D. Review the system log on a domain controller.

Discussion 0

Correct Answer: B Vote an answer

Question 11

Which of the following does the command nmap -open 10.10.10.3 do?

A. Execute a scan on a subnet, returning detailed information on open ports. B. Execute a scan on a subnet, returning all hosts with open ports. C. Execute a scan on a single host, returning open services. D. Execute a scan on a single host, returning only open ports.

Discussion 0

Correct Answer: C Vote an answer

Question 12

Which two answer options are the BEST reasons to conduct post-incident reviews after an incident occurs in an organization? (Choose two.)

A. To help leverage automated scanning tools and ad hoc tests B. To help identify event detection information. C. To help identify lessons learned and follow-up action. D. To help prevent an incident recurrence.

Discussion 0

Correct Answer: C,D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 13

During a malware-driven distributed denial of service attack, a security researcher found excessive requests to a name server referring to the same domain name and host name encoded in hexadecimal. The malware author used which type of command and control?

A. File Transfer Protocol (FTP) B. Custom channel C. Dnscat2 D. Internet Relay Chat (IRC)

Discussion 0

Correct Answer: A Vote an answer

Question 14

Organizations considered "covered entities" are required to adhere to which compliance requirement?

A. International Organization for Standardization (ISO) 27001 B. Sarbanes-Oxley Act (SOX) C. Health Insurance Portability and Accountability Act of 1996 (HIPAA) D. Payment Card Industry Data Security Standard (PCI DSS)

Discussion 0

Correct Answer: C Vote an answer

CertNexus CyberSec First Responder - CFR-410 Exam Practice Test