Test Online Free CertNexus CFR-410 Exam Questions and Answers
Practice a live sample before buying full access. This page keeps the free CFR-410 question set organized by page so visitors and search engines can reach the canonical -questions.html URL directly.
An incident responder discovers that the CEO logged in from their New York City office and then logged in from a location in Beijing an hour later. The incident responder suspects that the CEO’s account has been
compromised.
Which of the following anomalies MOST likely contributed to the incident responder’s suspicion?
An incident response team is concerned with verifying the integrity of security information and event management (SIEM) events after being written to disk.
Which of the following represents the BEST option for addressing this concern?
Which of the following would MOST likely make a Windows workstation on a corporate network vulnerable to remote exploitation?
Answer:
Question 6Selectable Answer
While performing routing maintenance on a Windows Server, a technician notices several unapproved Windows Updates and that remote access software has been installed. The technician suspects that a malicious actor has gained access to the system.
Which of the following steps in the attack process does this activity indicate?
Answer:
Question 7Selectable Answer
Which of the following, when exposed together, constitutes PII? (Choose two.)
A company website was hacked via the following SQL query:
email, passwd, login_id, full_name FROM members
WHERE email = “[email protected]”; DROP TABLE members; C”
Which of the following did the hackers perform?
Answer:
Question 9Selectable Answer
A company help desk is flooded with calls regarding systems experiencing slow performance and certain Internet sites taking a long time to load or not loading at all.
The security operations center (SOC) analysts who receive these calls take the following actions:
- Running antivirus scans on the affected user machines
- Checking department membership of affected users
- Checking the host-based intrusion prevention system (HIPS) console for affected user machine alerts
- Checking network monitoring tools for anomalous activities
Which of the following phases of the incident response process match the actions taken?
Answer:
Question 10Selectable Answer
Which of the following are part of the hardening phase of the vulnerability assessment process? (Choose two.)
Answer:
Question 11Selectable Answer
After imaging a disk as part of an investigation, a forensics analyst wants to hash the image using a tool that supports piecewise hashing.
Which of the following tools should the analyst use?
Answer:
Question 12Selectable Answer
During a log review, an incident responder is attempting to process the proxy server’s log files but finds that they are too large to be opened by any file viewer.
Which of the following is the MOST appropriate technique to open and analyze these log files?
A government organization responsible for critical infrastructure is being attacked and files on the server been deleted.
Which of the following are the most immediate communications that should be made regarding the incident? (Choose two.)
Answer:
Question 15Selectable Answer
Recently, a cybersecurity research lab discovered that there is a hacking group focused on hacking into the computers of financial executives in Company A to sell the exfiltrated information to Company B.
Which of the following threat motives does this MOST likely represent?
