最新のCertNexus CFR-410のPDFと問題集で（2022）無料試験問題解答 [Q45-Q64]

質問 45
A security operations center (SOC) analyst observed an unusually high number of login failures on a particular database server. The analyst wants to gather supporting evidence before escalating the observation to management. Which of the following expressions will provide login failure data for 11/24/2015?

質問 46
To minimize vulnerability, which steps should an organization take before deploying a new Internet of Things (IoT) device? (Choose two.)

質問 47
Malicious code designed to execute in concurrence with a particular event is BEST defined as which of the following?

質問 48
An administrator investigating intermittent network communication problems has identified an excessive amount of traffic from an external-facing host to an unknown location on the Internet. Which of the following BEST describes what is occurring?

質問 49
An incident handler is assigned to initiate an incident response for a complex network that has been affected by malware. Which of the following actions should be taken FIRST?

質問 50
Which of the following, when exposed together, constitutes PII? (Choose two.)

質問 51
During which of the following attack phases might a request sent to port 1433 over a whole company network be seen within a log?

質問 52
An incident responder has collected network capture logs in a text file, separated by five or more data fields.
Which of the following is the BEST command to use if the responder would like to print the file (to terminal/ screen) in numerical order?

質問 53
Which of the following types of attackers would be MOST likely to use multiple zero-day exploits executed against high-value, well-defended targets for the purposes of espionage and sabotage?

質問 54
A common formula used to calculate risk is: + Threats + Vulnerabilities = Risk. Which of the following represents the missing factor in this formula?

質問 55
Detailed step-by-step instructions to follow during a security incident are considered:

質問 56
A company has noticed a trend of attackers gaining access to corporate mailboxes. Which of the following would be the BEST action to take to plan for this kind of attack in the future?

質問 57
An attacker intercepts a hash and compares it to pre-computed hashes to crack a password. Which of the following methods has been used?

質問 58
When performing an investigation, a security analyst needs to extract information from text files in a Windows operating system. Which of the following commands should the security analyst use?

質問 59
An incident at a government agency has occurred and the following actions were taken:
– Users have regained access to email accounts
– Temporary VPN services have been removed
– Host-based intrusion prevention system (HIPS) and antivirus (AV) signatures have been updated
– Temporary email servers have been decommissioned
Which of the following phases of the incident response process match the actions taken?

質問 60
A security administrator notices a process running on their local workstation called SvrsScEsdKexzCv.exe.
The unknown process is MOST likely:

質問 61
Which of the following is the FIRST step taken to maintain the chain of custody in a forensic investigation?

質問 62
Which of the following are part of the hardening phase of the vulnerability assessment process? (Choose two.)

質問 63
A security investigator has detected an unauthorized insider reviewing files containing company secrets.
Which of the following commands could the investigator use to determine which files have been opened by this user?

質問 64
While performing routing maintenance on a Windows Server, a technician notices several unapproved Windows Updates and that remote access software has been installed. The technician suspects that a malicious actor has gained access to the system. Which of the following steps in the attack process does this activity indicate?