Get Jan-2023 Dumps to Pass your CFR-410 Exam with 100% Real Questions and Answers [Q25-Q46]

QUESTION 25
During an incident, the following actions have been taken:
– Executing the malware in a sandbox environment
– Reverse engineering the malware
– Conducting a behavior analysis
Based on the steps presented, which of the following incident handling processes has been taken?

QUESTION 26
While reviewing some audit logs, an analyst has identified consistent modifications to the sshd_config file for an organization’s server. The analyst would like to investigate and compare contents of the current file with archived versions of files that are saved weekly. Which of the following tools will be MOST effective during the investigation?

QUESTION 27
Which of the following are well-known methods that are used to protect evidence during the forensics process? (Choose three.)

QUESTION 28
An administrator believes that a system on VLAN 12 is Address Resolution Protocol (ARP) poisoning clients on the network. The administrator attaches a system to VLAN 12 and uses Wireshark to capture traffic. After reviewing the capture file, the administrator finds no evidence of ARP poisoning. Which of the following actions should the administrator take next?

QUESTION 29
Which of the following describes United States federal government cybersecurity policies and guidelines?

QUESTION 30
A company website was hacked via the following SQL query:
email, passwd, login_id, full_name FROM members
WHERE email = “[email protected]”; DROP TABLE members; -“
Which of the following did the hackers perform?

QUESTION 31
Various logs are collected for a data leakage case to make a forensic analysis. Which of the following are MOST important for log integrity? (Choose two.)

QUESTION 32
An incident at a government agency has occurred and the following actions were taken:
– Users have regained access to email accounts
– Temporary VPN services have been removed
– Host-based intrusion prevention system (HIPS) and antivirus (AV) signatures have been updated
– Temporary email servers have been decommissioned
Which of the following phases of the incident response process match the actions taken?

QUESTION 33
Nmap is a tool most commonly used to:

QUESTION 34
Malicious code designed to execute in concurrence with a particular event is BEST defined as which of the following?

QUESTION 35
A security investigator has detected an unauthorized insider reviewing files containing company secrets.
Which of the following commands could the investigator use to determine which files have been opened by this user?

QUESTION 36
A web server is under a denial of service (DoS) attack. The administrator reviews logs and creates an access control list (ACL) to stop the attack. Which of the following technologies could perform these steps automatically in the future?

QUESTION 37
While performing routing maintenance on a Windows Server, a technician notices several unapproved Windows Updates and that remote access software has been installed. The technician suspects that a malicious actor has gained access to the system. Which of the following steps in the attack process does this activity indicate?

QUESTION 38
During the forensic analysis of a compromised computer image, the investigator found that critical files are missing, caches have been cleared, and the history and event log files are empty. According to this scenario, which of the following techniques is the suspect using?

QUESTION 39
A Linux administrator is trying to determine the character count on many log files. Which of the following command and flag combinations should the administrator use?

QUESTION 40
Which of the following data sources could provide indication of a system compromise involving the exfiltration of data to an unauthorized destination?

QUESTION 41
While planning a vulnerability assessment on a computer network, which of the following is essential? (Choose two.)

QUESTION 42
In which of the following attack phases would an attacker use Shodan?

QUESTION 43
A network administrator has determined that network performance has degraded due to excessive use of social media and Internet streaming services. Which of the following would be effective for limiting access to these types of services, without completely restricting access to a site?

QUESTION 44
A security engineer is setting up security information and event management (SIEM). Which of the following log sources should the engineer include that will contain indicators of a possible web server compromise? (Choose two.)

QUESTION 45
An automatic vulnerability scan has been performed. Which is the next step of the vulnerability assessment process?

QUESTION 46
An organization recently suffered a breach due to a human resources administrator emailing employee names and Social Security numbers to a distribution list. Which of the following tools would help mitigate this risk from recurring?