CertNexus CFR-410 - CyberSec First Responder (CFR) Exam

During which phase of a vulnerability assessment would a security consultant need to document a requirement to retain a legacy device that is no longer supported and cannot be taken offline?

An administrator believes that a system on VLAN 12 is Address Resolution Protocol (ARP) poisoning clients on the network. The administrator attaches a system to VLAN 12 and uses Wireshark to capture traffic. After

reviewing the capture file, the administrator finds no evidence of ARP poisoning. Which of the following actions should the administrator take next?

A security analyst is required to collect detailed network traffic on a virtual machine. Which of the following tools could the analyst use?

Which of the following digital forensic goals is being provided with hashing and time-stamping of the electronic evidence?

What are three examples of incident response? (Choose three.)

A user receives an email about an unfamiliar bank transaction, which includes a link. When clicked, the link redirects the user to a web page that looks exactly like their bank’s website and asks them to log in with their username and password. Which type of attack is this?

During an incident, the following actions have been taken:

-Executing the malware in a sandbox environment

-Reverse engineering the malware

-Conducting a behavior analysis

Based on the steps presented, which of the following incident handling processes has been taken?

Recently, a cybersecurity research lab discovered that there is a hacking group focused on hacking into the computers of financial executives in Company A to sell the exfiltrated information to Company B. Which of the

following threat motives does this MOST likely represent?

Windows Server 2016 log files can be found in which of the following locations?

The NIST framework 800-137 breaks down the concept of continuous monitoring into which system of tiers?