Updated Apr-2023 100% Cover Real CFR-410 Exam Questions – 100% Pass Guarantee [Q17-Q39]

Q17. Which of the following is a cybersecurity solution for insider threats to strengthen information protection?

Q18. According to company policy, all accounts with administrator privileges should have suffix _j a. While reviewing Windows workstation configurations, a security administrator discovers an account without the suffix in the administrator’s group. Which of the following actions should the security administrator take?

Q19. A network administrator has determined that network performance has degraded due to excessive use of social media and Internet streaming services. Which of the following would be effective for limiting access to these types of services, without completely restricting access to a site?

Q20. Which of the following is a method of reconnaissance in which a ping is sent to a target with the expectation of receiving a response?

Q21. The incident response team has completed root cause analysis for an incident. Which of the following actions should be taken in the next phase of the incident response process? (Choose two.)

Q22. A Windows system administrator has received notification from a security analyst regarding new malware that executes under the process name of “armageddon.exe” along with a request to audit all department workstations for its presence. In the absence of GUI-based tools, what command could the administrator execute to complete this task?

Q23. An incident at a government agency has occurred and the following actions were taken:
– Users have regained access to email accounts
– Temporary VPN services have been removed
– Host-based intrusion prevention system (HIPS) and antivirus (AV) signatures have been updated
– Temporary email servers have been decommissioned
Which of the following phases of the incident response process match the actions taken?

Q24. Tcpdump is a tool that can be used to detect which of the following indicators of compromise?

Q25. A security administrator notices a process running on their local workstation called SvrsScEsdKexzCv.exe.
The unknown process is MOST likely:

Q26. A company that maintains a public city infrastructure was breached and information about future city projects was leaked. After the post-incident phase of the process has been completed, which of the following would be PRIMARY focus of the incident response team?

Q27. Which of the following are part of the hardening phase of the vulnerability assessment process? (Choose two.)

Q28. A Linux system administrator found suspicious activity on host IP 192.168.10.121. This host is also establishing a connection to IP 88.143.12.123. Which of the following commands should the administrator use to capture only the traffic between the two hosts?

Q29. Which of the following is susceptible to a cache poisoning attack?

Q30. A company has noticed a trend of attackers gaining access to corporate mailboxes. Which of the following would be the BEST action to take to plan for this kind of attack in the future?

Q31. During the forensic analysis of a compromised computer image, the investigator found that critical files are missing, caches have been cleared, and the history and event log files are empty. According to this scenario, which of the following techniques is the suspect using?

Q32. A suspicious script was found on a sensitive research system. Subsequent analysis determined that proprietary data would have been deleted from both the local server and backup media immediately following a specific administrator’s removal from an employee list that is refreshed each evening. Which of the following BEST describes this scenario?

Q33. During a log review, an incident responder is attempting to process the proxy server’s log files but finds that they are too large to be opened by any file viewer. Which of the following is the MOST appropriate technique to open and analyze these log files?

Q34. While performing routing maintenance on a Windows Server, a technician notices several unapproved Windows Updates and that remote access software has been installed. The technician suspects that a malicious actor has gained access to the system. Which of the following steps in the attack process does this activity indicate?

Q35. A security administrator needs to review events from different systems located worldwide. Which of the following is MOST important to ensure that logs can be effectively correlated?

Q36. Which asset would be the MOST desirable for a financially motivated attacker to obtain from a health insurance company?

Q37. An attacker intercepts a hash and compares it to pre-computed hashes to crack a password. Which of the following methods has been used?

Q38. Which of the following are well-known methods that are used to protect evidence during the forensics process? (Choose three.)

Q39. An incident responder was asked to analyze malicious traffic. Which of the following tools would be BEST for this?