CFR-410 CyberSec First Responder (CFR) Exam Question and Answers

As part of an organization’s regular maintenance activities, a security engineer visits the Internet Storm Center advisory page to obtain the latest list of blacklisted host/network addresses. The security engineer does this to perform which of the following activities?

If a hacker is attempting to alter or delete system audit logs, in which of the following attack phases is the hacker involved?

An unauthorized network scan may be detected by parsing network sniffer data for:

To minimize vulnerability, which steps should an organization take before deploying a new Internet of Things (IoT) device? (Choose two.)

A user receives an email about an unfamiliar bank transaction, which includes a link. When clicked, the link redirects the user to a web page that looks exactly like their bank’s website and asks them to log in with their username and password. Which type of attack is this?

Which of the following methods are used by attackers to find new ransomware victims? (Choose two.)

During a security investigation, a suspicious Linux laptop is found in the server room. The laptop is processing information and indicating network activity. The investigator is preparing to launch an investigation to

determine what is happening with this laptop. Which of the following is the MOST appropriate set of Linux commands that should be executed to conduct the investigation?

An incident responder has collected network capture logs in a text file, separated by five or more data fields.

Which of the following is the BEST command to use if the responder would like to print the file (to terminal/ screen) in numerical order?

In which of the following attack phases would an attacker use Shodan?

Which of the following would MOST likely make a Windows workstation on a corporate network vulnerable to remote exploitation?

An incident responder was asked to analyze malicious traffic. Which of the following tools would be BEST for this?

An automatic vulnerability scan has been performed. Which is the next step of the vulnerability assessment process?