CFR-210 Exam Training Practice Tests (Logical Operations CyberSec First Responder)]

Question 1

As part of an incident response effort, data has been collected and analyzed, and a malware infection has
been contained . Which of the following is the NEXT step the incident response team should take within
the incident response process?

A. Discuss lessons learned before proceeding with other steps. B. Ensure every instance of the malware has been removed across the organization. C. Begin recovering all infected systems to return the organization to normal operations as soon as
possible. D. Start writing the report to ensure a quality product is delivered by the end of the project.

Correct Answer: B

Question 2

Which of the following commands should be used to print out ONLY the second column of items in the
following file?
Source_File,txt
Alpha Whiskey
Bravo Tango
Charlie Foxtrot
Echo Oscar
Delta Roger

A. cut -d 11 11 -f2 source_file.txt B. cut -c6-12 Source_File.txt C. cut -d 11 11 -f2 Source_File.txt D. cut -b7-15 source_file.txt

Correct Answer: B

Question 3

A high-level government official uses anonymous bank accounts to transfer a requested amount of funds
to individuals in another country. These individuals are known for defacing government websites and
exfiltrating sensitive data. Which of the following BEST describes the involved threat actors?

A. Gray hat hackers B. Cyber terrorists C. Hacktivists D. State-sponsored hackers

Correct Answer: B

Question 4

During an investigation on Windows 10 system, a system administrator needs to analyze Windows event
logs related to CD/DVD-burning activities. In which of the following paths will the system administrator find
these logs?

A. \Windows\System32\winevt\Logs\System.evtx B. \Windows\Systems32\winevt\logs\System.evt C. \Windows\Systems\winevt\Evtlogs\System.evtx D. \Windows\System\winevt\Logs\System.evt

Correct Answer: A

Question 5

A user reports a pop-up error when starting a Windows machine. The error states that the machine has
been infected with a virus and instructs the user to download a new antivirus client. In which of the
following locations should the incident responder check to find what is generating the error message?
(Choose two.)

A. Programs and Features B. Browser history C. Auto-start registry keys D. Device Manager E. Event Viewer

Correct Answer: C,E

Question 6

A security professional has been tasked with the protection of a specific set of information essential to a
corporation's livelihood, the exposure of which could cost the company billions of dollars in long-term
revenue. The professional is interested in obtaining advice for preventing the theft of this type of
information. Which of the following is the BEST resource for finding this material?

A. Blogs concerning the theft of PII B. Vendor web pages that provide intelligence feeds and advisories C. National Threat Assessment Center D. Law enforcement information sharing groups

Correct Answer: D

Question 7

DRAG DROP
Drag and drop the following steps to perform a successful social engineering attack in the correct order,
from first (1) to last (6).

Correct Answer:

Question 8

During a network-based attack, which of the following data sources will provide the BEST data to quickly
determine the attacker's point of origin? (Choose two.)

A. System logs B. IDS/IPS logs C. WIPS logs D. DNS logs E. Firewall logs

Correct Answer: D,E

Question 9

A DMZ web server has been compromised. During the log review, the incident responder wants to parse all common internal Class A addresses from the log.
Which of the following commands should the responder use to accomplish this?

A. grep -x"(192.168.[0.9]+[0-9])" bin/apache2/access.log I output.txt B. grep -v"(10.[0-9]+.[0-9]+.[0-9]+)" /var/log/apache2/access.log > output.txt C. grep -x"(10.[0-9]+.[0-9]+.[0-9]+)" etc/rc.d/apache2/access.log I output.txt D. grep -v"(192.168.[0.9]+[0-9]+)" /var/log/apache2/access.log > output.txt

Correct Answer: B

Question 10

Organizations should exercise their Incident Response (IR) plan following initial creation. The primary
objective for this first I R plan exercise is to identify:

A. capabilities required to improve response time. B. critical steps required in the case of an incident. C. deficiencies in cyber security incident response team skills. D. gaps or overlaps in supporting processes and procedures.

Correct Answer: A

Logical Operations CyberSec First Responder - CFR-210 Exam Practice Test