certnexus cfr-410 practice test

CyberSec First Responder

Last exam update: Nov 18 ,2025
Page 1 out of 12. Viewing questions 1-15 out of 180

Question 1

A network security analyst has noticed a flood of Simple Mail Transfer Protocol (SMTP) traffic to
internal clients. SMTP traffic should only be allowed to email servers. Which of the following
commands would stop this attack? (Choose two.)

  • A. iptables -A INPUT -p tcp –dport 25 -d x.x.x.x -j ACCEPT
  • B. iptables -A INPUT -p tcp –sport 25 -d x.x.x.x -j ACCEPT
  • C. iptables -A INPUT -p tcp –dport 25 -j DROP
  • D. iptables -A INPUT -p tcp –destination-port 21 -j DROP
  • E. iptables -A FORWARD -p tcp –dport 6881:6889 -j DROP
Mark Question:
Answer:

AC


User Votes:
A
50%
B
50%
C
50%
D
50%
E
50%
Discussions
vote your answer:
A
B
C
D
E
0 / 1000

Question 2

A secretary receives an email from a friend with a picture of a kitten in it. The secretary forwards it to
the
~COMPANYWIDE mailing list and, shortly thereafter, users across the company receive the following
message:
“You seem tense. Take a deep breath and relax!”
The incident response team is activated and opens the picture in a virtual machine to test it. After a
short analysis, the following code is found in C:
\Temp\chill.exe:Powershell.exe –Command “do {(for /L %i in (2,1,254) do shutdown /r /m Error!
Hyperlink reference not valid.> /f /t / 0 (/c “You seem tense. Take a deep breath and relax!”);Start-
Sleep –s 900) } while(1)”
Which of the following BEST represents what the attacker was trying to accomplish?

  • A. Taunt the user and then trigger a shutdown every 15 minutes.
  • B. Taunt the user and then trigger a reboot every 15 minutes.
  • C. Taunt the user and then trigger a shutdown every 900 minutes.
  • D. Taunt the user and then trigger a reboot every 900 minutes.
Mark Question:
Answer:

B


User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 3

A Linux system administrator found suspicious activity on host IP 192.168.10.121. This host is also
establishing a connection to IP 88.143.12.123. Which of the following commands should the
administrator use to capture only the traffic between the two hosts?

  • A. # tcpdump -i eth0 host 88.143.12.123
  • B. # tcpdump -i eth0 dst 88.143.12.123
  • C. # tcpdump -i eth0 host 192.168.10.121
  • D. # tcpdump -i eth0 src 88.143.12.123
Mark Question:
Answer:

B


User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 4

After imaging a disk as part of an investigation, a forensics analyst wants to hash the image using a
tool that supports piecewise hashing. Which of the following tools should the analyst use?

  • A. md5sum
  • B. sha256sum
  • C. md5deep
  • D. hashdeep
Mark Question:
Answer:

A


User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 5

Which of the following is a cybersecurity solution for insider threats to strengthen information
protection?

  • A. Web proxy
  • B. Data loss prevention (DLP)
  • C. Anti-malware
  • D. Intrusion detection system (IDS)
Mark Question:
Answer:

B


Explanation:
Reference: https://www.techrepublic.com/article/how-to-protect-your-organization-against-insider-
threats/

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 6

A security administrator is investigating a compromised host. Which of the following commands
could the investigator use to display executing processes in real time?

  • A. ps
  • B. top
  • C. nice
  • D. pstree
Mark Question:
Answer:

B


Explanation:
Reference: https://www.cyberciti.biz/faq/show-all-running-processes-in-linux/

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 7

A system administrator identifies unusual network traffic from outside the local network. Which of
the following
is the BEST method for mitigating the threat?

  • A. Malware scanning
  • B. Port blocking
  • C. Packet capturing
  • D. Content filtering
Mark Question:
Answer:

C


User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 8

Which of the following technologies would reduce the risk of a successful SQL injection attack?

  • A. Reverse proxy
  • B. Web application firewall
  • C. Stateful firewall
  • D. Web content filtering
Mark Question:
Answer:

B


Explanation:
Reference: http://www.enterprisenetworkingplanet.com/netsecur/article.php/3866756/10-Ways-to-
Prevent-or- Mitigate-SQL-Injection-Attacks.htm

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 9

An incident responder has collected network capture logs in a text file, separated by five or more
data fields.
Which of the following is the BEST command to use if the responder would like to print the file (to
terminal/ screen) in numerical order?

  • A. cat | tac
  • B. more
  • C. sort –n
  • D. less
Mark Question:
Answer:

C


Explanation:
Reference: https://kb.iu.edu/d/afjb

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 10

Which of the following characteristics of a web proxy strengthens cybersecurity? (Choose two.)

  • A. Increases browsing speed
  • B. Filters unwanted content
  • C. Limits direct connection to Internet
  • D. Caches frequently-visited websites
  • E. Decreases wide area network (WAN) traffic
Mark Question:
Answer:

AD


User Votes:
A
50%
B
50%
C
50%
D
50%
E
50%
Discussions
vote your answer:
A
B
C
D
E
0 / 1000

Question 11

A cybersecurity expert assigned to be the IT manager of a middle-sized company discovers that there
is little endpoint security implementation on the company’s systems. Which of the following could
be included in an endpoint security solution? (Choose two.)

  • A. Web proxy
  • B. Network monitoring system
  • C. Data loss prevention (DLP)
  • D. Anti-malware
  • E. Network Address Translation (NAT)
Mark Question:
Answer:

AB


User Votes:
A
50%
B
50%
C
50%
D
50%
E
50%
Discussions
vote your answer:
A
B
C
D
E
0 / 1000

Question 12

During a security investigation, a suspicious Linux laptop is found in the server room. The laptop is
processing information and indicating network activity. The investigator is preparing to launch an
investigation to
determine what is happening with this laptop. Which of the following is the MOST appropriate set of
Linux commands that should be executed to conduct the investigation?

  • A. iperf, traceroute, whois, ls, chown, cat
  • B. iperf, wget, traceroute, dc3dd, ls, whois
  • C. lsof, chmod, nano, whois, chown, ls
  • D. lsof, ifconfig, who, ps, ls, tcpdump
Mark Question:
Answer:

B


User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 13

A security analyst is required to collect detailed network traffic on a virtual machine. Which of the
following tools could the analyst use?

  • A. nbtstat
  • B. WinDump
  • C. fport
  • D. netstat
Mark Question:
Answer:

D


User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 14

After a security breach, a security consultant is hired to perform a vulnerability assessment for a
company’s web application. Which of the following tools would the consultant use?

  • A. Nikto
  • B. Kismet
  • C. tcpdump
  • D. Hydra
Mark Question:
Answer:

A


Explanation:
Reference: https://www.scnsoft.com/blog/network-vulnerability-assessment-guide

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 15

When performing an investigation, a security analyst needs to extract information from text files in a
Windows operating system. Which of the following commands should the security analyst use?

  • A. findstr
  • B. grep
  • C. awk
  • D. sigverif
Mark Question:
Answer:

C


User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000
To page 2