Logical Operations Logical Operations Certifications CFR-410 Questions & Answers

• Question 71:

  A company help desk is flooded with calls regarding systems experiencing slow performance and certain Internet sites taking a long time to load or not loading at all. The security operations center (SOC) analysts who receive these calls take the following actions:

  -Running antivirus scans on the affected user machines

  -

  Checking department membership of affected users

  -

  Checking the host-based intrusion prevention system (HIPS) console for affected user machine alerts

  -

  Checking network monitoring tools for anomalous activities

  Which of the following phases of the incident response process match the actions taken?

  A. Identification

  B. Preparation

  C. Recovery

  D. Containment

  Correct Answer: A

• Question 72:

  According to Payment Card Industry Data Security Standard (PCI DSS) compliance requirements, an organization must retain logs for what length of time?

  A. 3 months

  B. 6 months

  C. 1 year

  D. 5 years

  Correct Answer: C

  Reference: https://www.pcisecuritystandards.org/documents/Prioritized-Approach-for-PCI_DSS-v3_2.pdf

• Question 73:

  Senior management has stated that antivirus software must be installed on all employee workstations. Which of the following does this statement BEST describe?

  A. Guideline

  B. Procedure

  C. Policy

  D. Standard

  Correct Answer: C

• Question 74:

  Which of the following enables security personnel to have the BEST security incident recovery practices?

  A. Crisis communication plan

  B. Disaster recovery plan

  C. Occupant emergency plan

  D. Incident response plan

  Correct Answer: B

• Question 75:

  The incident response team has completed root cause analysis for an incident. Which of the following actions should be taken in the next phase of the incident response process? (Choose two.)

  A. Providing a briefing to management

  B. Updating policies and procedures

  C. Training staff for future incidents

  D. Investigating responsible staff

  E. Drafting a recovery plan for the incident

  Correct Answer: BE

• Question 76:

  Detailed step-by-step instructions to follow during a security incident are considered:

  A. Policies

  B. Guidelines

  C. Procedures

  D. Standards

  Correct Answer: C

• Question 77:

  An incident handler is assigned to initiate an incident response for a complex network that has been affected by malware. Which of the following actions should be taken FIRST?

  A. Make an incident response plan.

  B. Prepare incident response tools.

  C. Isolate devices from the network.

  D. Capture network traffic for analysis.

  Correct Answer: D

• Question 78:

  During an incident, the following actions have been taken:

  -Executing the malware in a sandbox environment

  -Reverse engineering the malware

  -Conducting a behavior analysis

  Based on the steps presented, which of the following incident handling processes has been taken?

  A. Containment

  B. Eradication

  C. Recovery

  D. Identification

  Correct Answer: A

  The "Containment, eradication and recovery" phase is the period in which incident response team tries to contain the incident and, if necessary, recover from it (restore any affected resources, data and/or processes).

  Reference: https://blog.rapid7.com/2017/01/11/introduction-to-incident-response-life-cycle-of-nist-sp-800-61/

• Question 79:

  An incident at a government agency has occurred and the following actions were taken:

  -Users have regained access to email accounts

  -Temporary VPN services have been removed

  -Host-based intrusion prevention system (HIPS) and antivirus (AV) signatures have been updated

  -

  Temporary email servers have been decommissioned

  Which of the following phases of the incident response process match the actions taken?

  A.

  Containment

  B.

  Post-incident

  C.

  Recovery

  D. Identification

  Correct Answer: A

• Question 80:

  Organizations considered "covered entities" are required to adhere to which compliance requirement?

  A. Health Insurance Portability and Accountability Act of 1996 (HIPAA)

  B. Payment Card Industry Data Security Standard (PCI DSS)

  C. Sarbanes-Oxley Act (SOX)

  D. International Organization for Standardization (ISO) 27001

  Correct Answer: A

  Reference: https://www.hhs.gov/hipaa/for-professionals/faq/190/who-must-comply-with-hipaa-privacy-standards/index.html