CyberSec First Responder - CFR-410 Exam Practice Test

Question 1

A digital forensics investigation requires analysis of a compromised system's physical memory. Which of the following tools should the forensics analyst use to complete this task?

A. CAINE

B. Volatility

C. Autopsy

D. Wire shark

E. FTK

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 2

Which of the following attack vectors capitalizes on a previously undisclosed issue with a software application?

A. Zero-Day Exploit

B. Brute Force

C. Phishing

D. Misconfiguration

E. Ransomware

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 3

A Linux system administrator found suspicious activity on host IP 192.168.10.121. This host is also establishing a connection to IP 88.143.12.123. Which of the following commands should the administrator use to capture only the traffic between the two hosts?

A. # tcpdump -i eth0 host 192.168.10.121

B. # tcpdump -i eth0 dst 88.143.12.123

C. # tcpdump -i eth0 host 88.143.12.123

D. # tcpdump -i eth0 src 88.143.12.123

Correct Answer: B

Question 4

What is the primary role of an intrusion detection system (IDS) on a network?

A. Detection of system failures

B. Blocking malicious packets

C. Detection of possible threats

D. Detection of network vulnerabilities

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 5

An automatic vulnerability scan has been performed. Which is the next step of the vulnerability assessment process?

A. Generating reports

B. Assessing identified exposures

C. Documenting exceptions

D. Hardening the infrastructure

Correct Answer: A

Question 6

As part of an organization's regular maintenance activities, a security engineer visits the Internet Storm Center advisory page to obtain the latest list of blacklisted host/network addresses. The security engineer does this to perform which of the following activities?

A. Monitor the organization's sensitive databases

B. Update the latest proxy access list

C. Update access control list (ACL) rules for network devices

D. Monitor the organization's network for suspicious traffic

Correct Answer: C

Question 7

Which of the following, when exposed together, constitutes PII? (Choose two.)

A. Birth date

B. Employment status

C. Full name

D. Marital status

E. Account balance

Correct Answer: C,E

Question 8

A company has noticed a trend of attackers gaining access to corporate mailboxes. Which of the following would be the BEST action to take to plan for this kind of attack in the future?

A. Hardening the Microsoft Exchange Server

B. Scanning email server for vulnerabilities

C. Auditing account password complexity

D. Conducting security awareness training

Correct Answer: B

Question 9

ABC Company uses technical compliance tests to verify that its IT systems are configured according to organizational information security policies, standards, and guidelines. Which two tools and controls can ABC Company use to verify that its IT systems are configured accordingly? (Choose two.)

A. Implementing Automated Key Management Procedures

B. Performing Vulnerability Assessments and Penetration Testing

C. Implementing Automated Human Resource Procedures

D. Implementing Baseline Configuration Security Controls

Correct Answer: B,D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 10

Which of the following could be useful to an organization that wants to test its incident response procedures without risking any system downtime?

A. Red team exercise

B. Blue team exercise

C. Business continuity exercise

D. Tabletop exercise

Correct Answer: C

Question 11

Which of the following is an automated password cracking technique that uses a combination of uppercase and lowercase letters, 0-9 numbers, and special characters?

A. Rainbow tables

B. Dictionary attack

C. Password guessing

D. Brute force attack

Correct Answer: D

Question 12

A security operations center (SOC) analyst observed an unusually high number of login failures on a particular database server. The analyst wants to gather supporting evidence before escalating the observation to management. Which of the following expressions will provide login failure data for 11/24/2015?

A. grep 20151124 security_log | grep "login"

B. grep 20151124 security_log | grep -c "login failure"

C. grep 20150124 security_log | grep "login_failure"

D. grep 20151124 security_log | grep -c "login"

Correct Answer: A

Question 13

Which of the following is a social engineering tactic in which an attacker engages in temptation or promise of a good or service?

A. Baiting

B. Phishing

C. Vishing

D. Pretexting

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 14

Which of the following types of digital evidence is considered the MOST volatile?

A. Data on a hard disk

B. Temporary file space

C. Random access memory

D. Swap file

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 15

Which of the following is the GREATEST risk of having security information and event management (SIEM) collect computer names with older log entries?

A. Domain Name System (DNS) records may have changed since the log was created.

B. There may be duplicate computer names on the network.

C. There may be field name duplication when combining log files.

D. The computer name may not be admissible evidence in court.

Correct Answer: C

CertNexus CyberSec First Responder - CFR-410 Exam Practice Test

Latest Update

Useful Links

Contact Us