Latest Success Metrics For Actual CFR-410 Exam 2023 Realistic Dumps
Updated CFR-410 Dumps Questions For CertNexus Exam
NEW QUESTION # 30
An incident responder discovers that the CEO logged in from their New York City office and then logged in from a location in Beijing an hour later. The incident responder suspects that the CEO's account has been compromised. Which of the following anomalies MOST likely contributed to the incident responder's suspicion?
- A. Geovelocity
- B. Geolocation
- C. Advanced persistent threat (APT) activity
- D. False positive
Answer: A
NEW QUESTION # 31
Which of the following are part of the hardening phase of the vulnerability assessment process? (Choose two.)
- A. Updating configurations
- B. Documenting exceptions
- C. Installing patches
- D. Generating reports
- E. Conducting audits
Answer: A,C
NEW QUESTION # 32
When attempting to determine which system or user is generating excessive web traffic, analysis of which of the following would provide the BEST results?
- A. HTTP logs
- B. Proxy logs
- C. Browser logs
- D. System logs
Answer: B
NEW QUESTION # 33
Tcpdump is a tool that can be used to detect which of the following indicators of compromise?
- A. Unusual network traffic
- B. Poor network performance
- C. Unknown open ports
- D. Unknown use of protocols
Answer: A
NEW QUESTION # 34
If a hacker is attempting to alter or delete system audit logs, in which of the following attack phases is the hacker involved?
- A. Expanding access
- B. Gaining persistence
- C. Covering tracks
- D. Performing reconnaissance
Answer: C
NEW QUESTION # 35
During a malware-driven distributed denial of service attack, a security researcher found excessive requests to a name server referring to the same domain name and host name encoded in hexadecimal. The malware author used which type of command and control?
- A. Custom channel
- B. Dnscat2
- C. Internet Relay Chat (IRC)
- D. File Transfer Protocol (FTP)
Answer: D
NEW QUESTION # 36
An unauthorized network scan may be detected by parsing network sniffer data for:
- A. IP traffic from multiple IP addresses to other networks.
- B. IP traffic from a single IP address to multiple IP addresses.
- C. IP traffic from a single IP address to a single IP address.
- D. IP traffic from multiple IP addresses to a single IP address.
Answer: D
NEW QUESTION # 37
Which of the following are common areas of vulnerabilities in a network switch? (Choose two.)
- A. Default IP address
- B. Default credentials
- C. Default protocols
- D. Default port state
- E. Default encryption
Answer: B,D
NEW QUESTION # 38
During which of the following attack phases might a request sent to port 1433 over a whole company network be seen within a log?
- A. Persistence
- B. Scanning
- C. Gaining access
- D. Reconnaissance
Answer: B
NEW QUESTION # 39
During an incident, the following actions have been taken:
- Executing the malware in a sandbox environment
- Reverse engineering the malware
- Conducting a behavior analysis
Based on the steps presented, which of the following incident handling processes has been taken?
- A. Identification
- B. Eradication
- C. Recovery
- D. Containment
Answer: D
Explanation:
The "Containment, eradication and recovery" phase is the period in which incident response team tries to contain the incident and, if necessary, recover from it (restore any affected resources, data and/or processes).
NEW QUESTION # 40
Which of the following could be useful to an organization that wants to test its incident response procedures without risking any system downtime?
- A. Red team exercise
- B. Tabletop exercise
- C. Blue team exercise
- D. Business continuity exercise
Answer: D
NEW QUESTION # 41
Which of the following attacks involves sending a large amount of spoofed User Datagram Protocol (UDP) traffic to a router's broadcast address within a network?
- A. Fraggle attack
- B. Teardrop attack
- C. Land attack
- D. Smurf attack
Answer: D
NEW QUESTION # 42
Which of the following would MOST likely make a Windows workstation on a corporate network vulnerable to remote exploitation?
- A. Enabling Remote Desktop
- B. Disabling Windows Firewall
- C. Enabling Remote Registry
- D. Disabling Windows Updates
Answer: A
NEW QUESTION # 43
A Linux administrator is trying to determine the character count on many log files. Which of the following command and flag combinations should the administrator use?
- A. tr -d
- B. wc -m
- C. grep -c
- D. uniq -c
Answer: B
NEW QUESTION # 44
A Windows system administrator has received notification from a security analyst regarding new malware that executes under the process name of "armageddon.exe" along with a request to audit all department workstations for its presence. In the absence of GUI-based tools, what command could the administrator execute to complete this task?
- A. top | grep armageddon
- B. wmic process list brief | find "armageddon.exe"
- C. wmic startup list full | find "armageddon.exe"
- D. ps -ef | grep armageddon
Answer: B
NEW QUESTION # 45
Which of the following is a method of reconnaissance in which a ping is sent to a target with the expectation of receiving a response?
- A. Passive scanning
- B. Application enumeration
- C. Active scanning
- D. Network enumeration
Answer: D
NEW QUESTION # 46
Which of the following is a cybersecurity solution for insider threats to strengthen information protection?
- A. Intrusion detection system (IDS)
- B. Data loss prevention (DLP)
- C. Anti-malware
- D. Web proxy
Answer: B
NEW QUESTION # 47
An incident at a government agency has occurred and the following actions were taken:
- Users have regained access to email accounts
- Temporary VPN services have been removed
- Host-based intrusion prevention system (HIPS) and antivirus (AV) signatures have been updated
- Temporary email servers have been decommissioned
Which of the following phases of the incident response process match the actions taken?
- A. Identification
- B. Post-incident
- C. Recovery
- D. Containment
Answer: D
NEW QUESTION # 48
Which of the following is susceptible to a cache poisoning attack?
- A. Hypertext Transfer Protocol (HTTP)
- B. Hypertext Transfer Protocol Secure (HTTPS)
- C. Domain Name System (DNS)
- D. Secure Shell (SSH)
Answer: C
NEW QUESTION # 49
......
Full CFR-410 Practice Test and 100 Unique Questions, Get it Now!: https://interfacett.braindumpquiz.com/CFR-410-exam-material.html