Logical Operations Logical Operations Certifications CFR-410 Questions & Answers

• Question 31:

  An administrator believes that a system on VLAN 12 is Address Resolution Protocol (ARP) poisoning clients on the network. The administrator attaches a system to VLAN 12 and uses Wireshark to capture traffic. After reviewing the capture file, the administrator finds no evidence of ARP poisoning. Which of the following actions should the administrator take next?

  A. Clear the ARP cache on their system.

  B. Enable port mirroring on the switch.

  C. Filter Wireshark to only show ARP traffic.

  D. Configure the network adapter to promiscuous mode.

  Correct Answer: D

  Reference: https://www.tutorialspoint.com/ethical_hacking/ethical_hacking_arp_poisoning.htm

• Question 32:

  An organization recently suffered a breach due to a human resources administrator emailing employee names and Social Security numbers to a distribution list. Which of the following tools would help mitigate this risk from recurring?

  A. Data loss prevention (DLP)

  B. Firewall

  C. Web proxy

  D. File integrity monitoring

  Correct Answer: A

• Question 33:

  An incident responder was asked to analyze malicious traffic. Which of the following tools would be BEST for this?

  A. Hex editor

  B. tcpdump

  C. Wireshark

  D. Snort

  Correct Answer: C

  Reference: https://resources.infosecinstitute.com/category/certifications-training/network-traffic-analysis-for-incident-response/threat-intelligence-collection-and-analysis/analyzing-fileless-malware/#gref

• Question 34:

  A network administrator has determined that network performance has degraded due to excessive use of social media and Internet streaming services. Which of the following would be effective for limiting access to these types of services, without completely restricting access to a site?

  A. Whitelisting

  B. Web content filtering

  C. Network segmentation

  D. Blacklisting

  Correct Answer: B

  Reference: https://umbrella.cisco.com/solutions/web-content-filtering

• Question 35:

  A web server is under a denial of service (DoS) attack. The administrator reviews logs and creates an access control list (ACL) to stop the attack. Which of the following technologies could perform these steps automatically in the future?

  A. Intrusion prevention system (IPS)

  B. Intrusion detection system (IDS)

  C. Blacklisting

  D. Whitelisting

  Correct Answer: B

  Reference: https://www.ciscopress.com/articles/article.asp?p=345618

• Question 36:

  Which of the following does the command nmap –open 10.10.10.3 do?

  A. Execute a scan on a single host, returning only open ports.

  B. Execute a scan on a subnet, returning detailed information on open ports.

  C. Execute a scan on a subnet, returning all hosts with open ports.

  D. Execute a scan on a single host, returning open services.

  Correct Answer: D

• Question 37:

  A security analyst is required to collect detailed network traffic on a virtual machine. Which of the following tools could the analyst use?

  A. nbtstat

  B. WinDump

  C. fport

  D. netstat

  Correct Answer: D

• Question 38:

  After a security breach, a security consultant is hired to perform a vulnerability assessment for a company's web application. Which of the following tools would the consultant use?

  A. Nikto

  B. Kismet

  C. tcpdump

  D. Hydra

  Correct Answer: A

  Reference: https://www.scnsoft.com/blog/network-vulnerability-assessment-guide

• Question 39:

  When performing an investigation, a security analyst needs to extract information from text files in a Windows operating system. Which of the following commands should the security analyst use?

  A. findstr

  B. grep

  C. awk

  D. sigverif

  Correct Answer: C

  Reference: https://books.google.com.pk/books?id=8qTxCAAAQBAJandpg=PA6andlpg=PA6anddq=awk+extract+information+from+text+files+in+a+Windows+operating +systemandsource=blandots=mm7bH69viVandsig=ACfU3U2sg2lNmZXZW0FKQWctyfH89yAz3Qandhl=enandsa=Xandved=2ahUKEwiFioWCgbbpAhVFQBoKHavGAcUQ6AEwAHoECBQQAQ#v=onepageandq=awk%20extract%20information%20from% 20text%20files%20in%20a%20Windows%20operating%20systemandf=false

• Question 40:

  During a security investigation, a suspicious Linux laptop is found in the server room. The laptop is processing information and indicating network activity. The investigator is preparing to launch an investigation to determine what is happening with this laptop. Which of the following is the MOST appropriate set of Linux commands that should be executed to conduct the investigation?

  A. iperf, traceroute, whois, ls, chown, cat

  B. iperf, wget, traceroute, dc3dd, ls, whois

  C. lsof, chmod, nano, whois, chown, ls

  D. lsof, ifconfig, who, ps, ls, tcpdump

  Correct Answer: B