CFR-410 Tested & Approved CertNexus Certification Study Materials [Q19-Q43]

NEW QUESTION 19
A Windows system administrator has received notification from a security analyst regarding new malware that executes under the process name of “armageddon.exe” along with a request to audit all department workstations for its presence. In the absence of GUI-based tools, what command could the administrator execute to complete this task?

NEW QUESTION 20
Which of the following characteristics of a web proxy strengthens cybersecurity? (Choose two.)

NEW QUESTION 21
A suspicious script was found on a sensitive research system. Subsequent analysis determined that proprietary data would have been deleted from both the local server and backup media immediately following a specific administrator’s removal from an employee list that is refreshed each evening. Which of the following BEST describes this scenario?

NEW QUESTION 22
Which of the following does the command nmap -open 10.10.10.3 do?

NEW QUESTION 23
A secretary receives an email from a friend with a picture of a kitten in it. The secretary forwards it to the
~COMPANYWIDE mailing list and, shortly thereafter, users across the company receive the following message:
“You seem tense. Take a deep breath and relax!”
The incident response team is activated and opens the picture in a virtual machine to test it. After a short analysis, the following code is found in C:
Tempchill.exe:Powershell.exe -Command “do {(for /L %i in (2,1,254) do shutdown /r /m Error! Hyperlink reference not valid.> /f /t / 0 (/c “You seem tense. Take a deep breath and relax!”);Start-Sleep -s 900) } while(1)” Which of the following BEST represents what the attacker was trying to accomplish?

NEW QUESTION 24
An administrator believes that a system on VLAN 12 is Address Resolution Protocol (ARP) poisoning clients on the network. The administrator attaches a system to VLAN 12 and uses Wireshark to capture traffic. After reviewing the capture file, the administrator finds no evidence of ARP poisoning. Which of the following actions should the administrator take next?

NEW QUESTION 25
Organizations considered “covered entities” are required to adhere to which compliance requirement?

NEW QUESTION 26
Which of the following attacks involves sending a large amount of spoofed User Datagram Protocol (UDP) traffic to a router’s broadcast address within a network?

NEW QUESTION 27
A company help desk is flooded with calls regarding systems experiencing slow performance and certain Internet sites taking a long time to load or not loading at all. The security operations center (SOC) analysts who receive these calls take the following actions:
– Running antivirus scans on the affected user machines
– Checking department membership of affected users
– Checking the host-based intrusion prevention system (HIPS) console for affected user machine alerts
– Checking network monitoring tools for anomalous activities
Which of the following phases of the incident response process match the actions taken?

NEW QUESTION 28
During a malware-driven distributed denial of service attack, a security researcher found excessive requests to a name server referring to the same domain name and host name encoded in hexadecimal. The malware author used which type of command and control?

NEW QUESTION 29
A common formula used to calculate risk is: + Threats + Vulnerabilities = Risk. Which of the following represents the missing factor in this formula?

NEW QUESTION 30
A cybersecurity expert assigned to be the IT manager of a middle-sized company discovers that there is little endpoint security implementation on the company’s systems. Which of the following could be included in an endpoint security solution? (Choose two.)

NEW QUESTION 31
An incident response team is concerned with verifying the integrity of security information and event management (SIEM) events after being written to disk. Which of the following represents the BEST option for addressing this concern?

NEW QUESTION 32
Which of the following is an automated password cracking technique that uses a combination of uppercase and lowercase letters, 0-9 numbers, and special characters?

NEW QUESTION 33
A security analyst is required to collect detailed network traffic on a virtual machine. Which of the following tools could the analyst use?

NEW QUESTION 34
Which of the following types of attackers would be MOST likely to use multiple zero-day exploits executed against high-value, well-defended targets for the purposes of espionage and sabotage?

NEW QUESTION 35
A system administrator identifies unusual network traffic from outside the local network. Which of the following is the BEST method for mitigating the threat?

NEW QUESTION 36
A security engineer is setting up security information and event management (SIEM). Which of the following log sources should the engineer include that will contain indicators of a possible web server compromise? (Choose two.)

NEW QUESTION 37
During a security investigation, a suspicious Linux laptop is found in the server room. The laptop is processing information and indicating network activity. The investigator is preparing to launch an investigation to determine what is happening with this laptop. Which of the following is the MOST appropriate set of Linux commands that should be executed to conduct the investigation?

NEW QUESTION 38
Which of the following is a method of reconnaissance in which a ping is sent to a target with the expectation of receiving a response?

NEW QUESTION 39
A web server is under a denial of service (DoS) attack. The administrator reviews logs and creates an access control list (ACL) to stop the attack. Which of the following technologies could perform these steps automatically in the future?

NEW QUESTION 40
During the forensic analysis of a compromised computer image, the investigator found that critical files are missing, caches have been cleared, and the history and event log files are empty. According to this scenario, which of the following techniques is the suspect using?

NEW QUESTION 41
Various logs are collected for a data leakage case to make a forensic analysis. Which of the following are MOST important for log integrity? (Choose two.)

NEW QUESTION 42
Which of the following enables security personnel to have the BEST security incident recovery practices?

NEW QUESTION 43
Which of the following are well-known methods that are used to protect evidence during the forensics process? (Choose three.)