Logical Operations Logical Operations Certifications CFR-410 Questions & Answers

• Question 81:

  Which of the following describes United States federal government cybersecurity policies and guidelines?

  A. NIST

  B. ANSI

  C. NERC

  D. GDPR

  Correct Answer: A

  Reference: https://www.gsa.gov/technology/government-it-initiatives/cybersecurity/cybersecurity-programs-policy

• Question 82:

  Which of the following are legally compliant forensics applications that will detect an alternative data stream (ADS) or a file with an incorrect file extension? (Choose two.)

  A. Disk duplicator

  B. EnCase

  C. dd

  D. Forensic Toolkit (FTK)

  E. Write blocker

  Correct Answer: BD

• Question 83:

  Which of the following is the GREATEST risk of having security information and event management (SIEM) collect computer names with older log entries?

  A. There may be duplicate computer names on the network.

  B. The computer name may not be admissible evidence in court.

  C. Domain Name System (DNS) records may have changed since the log was created.

  D. There may be field name duplication when combining log files.

  Correct Answer: D

• Question 84:

  A first responder notices a file with a large amount of clipboard information stored in it. Which part of the MITRE ATTandCK matrix has the responder discovered?

  A. Collection

  B. Discovery

  C. Lateral movement

  D. Exfiltration

  Correct Answer: D

  Reference: https://resources.infosecinstitute.com/mitre-attck-clipboard-data/#gref

• Question 85:

  Tcpdump is a tool that can be used to detect which of the following indicators of compromise?

  A. Unusual network traffic

  B. Unknown open ports

  C. Poor network performance

  D. Unknown use of protocols

  Correct Answer: A

  Reference: https://books.google.com.pk/books?id=b7swDwAAQBAJandpg=PA122andlpg=PA122anddq=Tcpdump+is+a+tool+that+can+be+used+to+detect+which+of+the+following+indicators+of +compromiseandsource=blandots=RxkWHHpNC4andsig=ACfU3U2L48OSw8R8HdLy2ytAuYsRDi9Hmgandhl=enandsa=Xandved=2ahUKEwi44PjnybbpAhVNzIUKHSloCJgQ6AEwAHoECBMQAQ#v=onepageandq=Tcpdump%20is%20a%20tool%20that% 20can%20be%20used%20to%20detect%20which%20of%20the%20following%20indicators%20of%20compromiseandf=false

• Question 86:

  When attempting to determine which system or user is generating excessive web traffic, analysis of which of the following would provide the BEST results?

  A. Browser logs

  B. HTTP logs

  C. System logs

  D. Proxy logs

  Correct Answer: D

  Reference: https://www.exabeam.com/siem-guide/events-and-logs/

• Question 87:

  Various logs are collected for a data leakage case to make a forensic analysis. Which of the following are MOST important for log integrity? (Choose two.)

  A. Hash value

  B. Time stamp

  C. Log type

  D. Modified date/time

  E. Log path

  Correct Answer: AB

• Question 88:

  When tracing an attack to the point of origin, which of the following items is critical data to map layer 2 switching?

  A. DNS cache

  B. ARP cache

  C. CAM table

  D. NAT table

  Correct Answer: B

  The host that owns the IP address sends an ARP reply message with its physical address. Each host machine maintains a table, called ARP cache, used to convert MAC addresses to IP addresses. Since ARP is a stateless protocol, every time a host gets an ARP reply from another host, even though it has not sent an ARP request for that reply, it accepts that ARP entry and updates its ARP cache. The process of updating a target host's ARP cache with a forged entry is referred to as poisoning.

  Reference: https://www.researchgate.net/publication/221056734_Securing_Layer_2_in_Local_Area_Networks

• Question 89:

  A Windows system administrator has received notification from a security analyst regarding new malware that executes under the process name of "armageddon.exe" along with a request to audit all department workstations for its presence. In the absence of GUI-based tools, what command could the administrator execute to complete this task?

  A. ps -ef | grep armageddon

  B. top | grep armageddon

  C. wmic process list brief | find "armageddon.exe"

  D. wmic startup list full | find "armageddon.exe"

  Correct Answer: C

  Reference: https://www.andreafortuna.org/2017/08/09/windows-command-line-cheatsheet-part-2-wmic/

• Question 90:

  A security analyst has discovered that an application has failed to run. Which of the following is the tool MOST likely used by the analyst for the initial discovery?

  A. syslog

  B. MSConfig

  C. Event Viewer

  D. Process Monitor

  Correct Answer: C