CFR-310 Exam Training Practice Tests (CertNexus CyberSec First Responder (CFR))]

Question 1

When tracing an attack to the point of origin, which of the following items is critical data to map layer 2 switching?

A. NAT table B. ARP cache C. CAM table D. DNS cache

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 2

An organization recently suffered a breach due to a human resources administrator emailing employee names and Social Security numbers to a distribution list. Which of the following tools would help mitigate this risk from recurring?

A. Data loss prevention (DLP) B. File integrity monitoring C. Firewall D. Web proxy

Correct Answer: A

Question 3

Recently, a cybersecurity research lab discovered that there is a hacking group focused on hacking into the computers of financial executives in Company A to sell the exfiltrated information to Company B.
Which of the following threat motives does this MOST likely represent?

A. Reputation/recognition B. Desire for financial gain C. Association/affiliation D. Desire for power

Correct Answer: B

Question 4

A system administrator identifies unusual network traffic from outside the local network. Which of the following is the BEST method for mitigating the threat?

A. Packet capturing B. Port blocking C. Content filtering D. Malware scanning

Correct Answer: A

Question 5

After successfully enumerating the target, the hacker determines that the victim is using a firewall. Which of the following techniques would allow the hacker to bypass the intrusion prevention system (IPS)?

A. Port scanning B. Xmas scanning C. Stealth scanning D. FINS scanning

Correct Answer: D

Question 6

Which of the following does the command nmap -open 10.10.10.3 do?

A. Execute a scan on a subnet, returning all hosts with open ports. B. Execute a scan on a subnet, returning detailed information on open ports. C. Execute a scan on a single host, returning open services. D. Execute a scan on a single host, returning only open ports.

Correct Answer: C

Question 7

Which of the following describes United States federal government cybersecurity policies and guidelines?

A. NERC B. GDPR C. ANSI D. NIST

Correct Answer: D

Question 8

A security administrator needs to review events from different systems located worldwide. Which of the following is MOST important to ensure that logs can be effectively correlated?

A. Logs should include the physical location of the action performed. B. Logs should contain the username of the user performing the action. C. Logs should be synchronized to a common, predefined time source. D. Logs should be synchronized to their local time zone.

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 9

An incident responder was asked to analyze malicious traffic. Which of the following tools would be BEST for this?

A. Snort B. tcpdump C. Hex editor D. Wireshark

Correct Answer: D

Question 10

According to company policy, all accounts with administrator privileges should have suffix _ja. While reviewing Windows workstation configurations, a security administrator discovers an account without the suffix in the administrator's group. Which of the following actions should the security administrator take?

A. Review the system log on the affected workstation. B. Review the system log on a domain controller. C. Review the security log on a domain controller. D. Review the security log on the affected workstation.

Correct Answer: C

CertNexus CyberSec First Responder (CFR) - CFR-310 Exam Practice Test