Logical Operations Logical Operations Certifications CFR-410 Questions & Answers

• Question 91:

  Which of the following data sources could provide indication of a system compromise involving the exfiltration of data to an unauthorized destination?

  A. IPS logs

  B. DNS logs

  C. SQL logs

  D. SSL logs

  Correct Answer: A

• Question 92:

  A security administrator needs to review events from different systems located worldwide. Which of the following is MOST important to ensure that logs can be effectively correlated?

  A. Logs should be synchronized to their local time zone.

  B. Logs should be synchronized to a common, predefined time source.

  C. Logs should contain the username of the user performing the action.

  D. Logs should include the physical location of the action performed.

  Correct Answer: A

• Question 93:

  A security administrator notices a process running on their local workstation called SvrsScEsdKexzCv.exe. The unknown process is MOST likely:

  A. Malware

  B. A port scanner

  C. A system process

  D. An application process

  Correct Answer: A

• Question 94:

  While reviewing some audit logs, an analyst has identified consistent modifications to the sshd_config file for an organization's server. The analyst would like to investigate and compare contents of the current file with archived versions of files that are saved weekly. Which of the following tools will be MOST effective during the investigation?

  A. cat * | cut –d ‘,’ –f 2,5,7

  B. more * | grep

  C. diff

  D. sort *

  Correct Answer: C

  Reference: https://www.tldp.org/LDP/abs/html/filearchiv.html

• Question 95:

  During a log review, an incident responder is attempting to process the proxy server's log files but finds that they are too large to be opened by any file viewer. Which of the following is the MOST appropriate technique to open and analyze these log files?

  A. Hex editor, searching

  B. tcpdump, indexing

  C. PE Explorer, indexing

  D. Notepad, searching

  Correct Answer: A

  Reference: https://superuser.com/questions/45142/hex-editor-for-large-files-in-linux

• Question 96:

  A company website was hacked via the following SQL query:

  email, passwd, login_id, full_name FROM members WHERE email = "attacker@somewhere.com"; DROP TABLE members; ?

  Which of the following did the hackers perform?

  A. Cleared tracks of attacker@somewhere.com entries

  B. Deleted the entire members table

  C. Deleted the email password and login details

  D. Performed a cross-site scripting (XSS) attack

  Correct Answer: C

• Question 97:

  An incident responder discovers that the CEO logged in from their New York City office and then logged in from a location in Beijing an hour later. The incident responder suspects that the CEO's account has been compromised. Which of the following anomalies MOST likely contributed to the incident responder's suspicion?

  A. Geolocation

  B. False positive

  C. Geovelocity

  D. Advanced persistent threat (APT) activity

  Correct Answer: C

  Reference: https://www.infosecurity-magazine.com/opinions/geo-velocity-adaptive/

• Question 98:

  An unauthorized network scan may be detected by parsing network sniffer data for:

  A. IP traffic from a single IP address to multiple IP addresses.

  B. IP traffic from a single IP address to a single IP address.

  C. IP traffic from multiple IP addresses to a single IP address.

  D. IP traffic from multiple IP addresses to other networks.

  Correct Answer: C

• Question 99:

  A security operations center (SOC) analyst observed an unusually high number of login failures on a particular database server. The analyst wants to gather supporting evidence before escalating the observation to management. Which of the following expressions will provide login failure data for 11/24/2015?

  A. grep 20151124 security_log | grep –c “login failure”

  B. grep 20150124 security_log | grep "login_failure"

  C. grep 20151124 security_log | grep "login"

  D. grep 20151124 security_log | grep –c “login”

  Correct Answer: C

• Question 100:

  A Linux administrator is trying to determine the character count on many log files. Which of the following command and flag combinations should the administrator use?

  A. tr -d

  B. uniq -c

  C. wc -m

  D. grep -c

  Correct Answer: C

  Reference: https://cmdlinetips.com/2011/08/how-to-count-the-number-of-lines-words-and-characters-in-a-text-file-from-terminal/