[Q54-Q77] Updated Jan-2023 Exam Engine or PDF for the CertNexus CFR-410 test to help you quickly prepare for the CertNexus exam!

NO.54 Which of the following data sources could provide indication of a system compromise involving the exfiltration of data to an unauthorized destination?

NO.55 Detailed step-by-step instructions to follow during a security incident are considered:

NO.56 Which of the following is the FIRST step taken to maintain the chain of custody in a forensic investigation?

NO.57 A network administrator has determined that network performance has degraded due to excessive use of social media and Internet streaming services. Which of the following would be effective for limiting access to these types of services, without completely restricting access to a site?

NO.58 A security administrator needs to review events from different systems located worldwide. Which of the following is MOST important to ensure that logs can be effectively correlated?

NO.59 According to company policy, all accounts with administrator privileges should have suffix _j a. While reviewing Windows workstation configurations, a security administrator discovers an account without the suffix in the administrator’s group. Which of the following actions should the security administrator take?

NO.60 Which of the following security best practices should a web developer reference when developing a new web- based application?

NO.61 After successfully enumerating the target, the hacker determines that the victim is using a firewall. Which of the following techniques would allow the hacker to bypass the intrusion prevention system (IPS)?

NO.62 An automatic vulnerability scan has been performed. Which is the next step of the vulnerability assessment process?

NO.63 To minimize vulnerability, which steps should an organization take before deploying a new Internet of Things (IoT) device? (Choose two.)

NO.64 Which of the following are part of the hardening phase of the vulnerability assessment process? (Choose two.)

NO.65 After a hacker obtained a shell on a Linux box, the hacker then sends the exfiltrated data via Domain Name System (DNS). This is an example of which type of data exfiltration?

NO.66 Which of the following is susceptible to a cache poisoning attack?

NO.67 A cybersecurity expert assigned to be the IT manager of a middle-sized company discovers that there is little endpoint security implementation on the company’s systems. Which of the following could be included in an endpoint security solution? (Choose two.)

NO.68 Which of the following is a method of reconnaissance in which a ping is sent to a target with the expectation of receiving a response?

NO.69 An organization recently suffered a breach due to a human resources administrator emailing employee names and Social Security numbers to a distribution list. Which of the following tools would help mitigate this risk from recurring?

NO.70 As part of an organization’s regular maintenance activities, a security engineer visits the Internet Storm Center advisory page to obtain the latest list of blacklisted host/network addresses. The security engineer does this to perform which of the following activities?

NO.71 A company that maintains a public city infrastructure was breached and information about future city projects was leaked. After the post-incident phase of the process has been completed, which of the following would be PRIMARY focus of the incident response team?

NO.72 Which of the following is an automated password cracking technique that uses a combination of uppercase and lowercase letters, 0-9 numbers, and special characters?

NO.73 An incident responder was asked to analyze malicious traffic. Which of the following tools would be BEST for this?

NO.74 An administrator believes that a system on VLAN 12 is Address Resolution Protocol (ARP) poisoning clients on the network. The administrator attaches a system to VLAN 12 and uses Wireshark to capture traffic. After reviewing the capture file, the administrator finds no evidence of ARP poisoning. Which of the following actions should the administrator take next?

NO.75 The incident response team has completed root cause analysis for an incident. Which of the following actions should be taken in the next phase of the incident response process? (Choose two.)

NO.76 Which of the following are well-known methods that are used to protect evidence during the forensics process? (Choose three.)

NO.77 Which of the following characteristics of a web proxy strengthens cybersecurity? (Choose two.)