2023 Valid CFR-410 test answers & CertNexus Exam PDF [Q28-Q48]

NO.28 An administrator investigating intermittent network communication problems has identified an excessive amount of traffic from an external-facing host to an unknown location on the Internet. Which of the following BEST describes what is occurring?

NO.29 An incident handler is assigned to initiate an incident response for a complex network that has been affected by malware. Which of the following actions should be taken FIRST?

NO.30 Senior management has stated that antivirus software must be installed on all employee workstations. Which of the following does this statement BEST describe?

NO.31 It was recently discovered that many of an organization’s servers were running unauthorized cryptocurrency mining software. Which of the following assets were being targeted in this attack? (Choose two.)

NO.32 While performing routing maintenance on a Windows Server, a technician notices several unapproved Windows Updates and that remote access software has been installed. The technician suspects that a malicious actor has gained access to the system. Which of the following steps in the attack process does this activity indicate?

NO.33 While planning a vulnerability assessment on a computer network, which of the following is essential? (Choose two.)

NO.34 A company help desk is flooded with calls regarding systems experiencing slow performance and certain Internet sites taking a long time to load or not loading at all. The security operations center (SOC) analysts who receive these calls take the following actions:
– Running antivirus scans on the affected user machines
– Checking department membership of affected users
– Checking the host-based intrusion prevention system (HIPS) console for affected user machine alerts
– Checking network monitoring tools for anomalous activities
Which of the following phases of the incident response process match the actions taken?

NO.35 Which of the following is a method of reconnaissance in which a ping is sent to a target with the expectation of receiving a response?

NO.36 Which of the following attacks involves sending a large amount of spoofed User Datagram Protocol (UDP) traffic to a router’s broadcast address within a network?

NO.37 Organizations considered “covered entities” are required to adhere to which compliance requirement?

NO.38 During which phase of a vulnerability assessment would a security consultant need to document a requirement to retain a legacy device that is no longer supported and cannot be taken offline?

NO.39 A company has noticed a trend of attackers gaining access to corporate mailboxes. Which of the following would be the BEST action to take to plan for this kind of attack in the future?

NO.40 A security analyst is required to collect detailed network traffic on a virtual machine. Which of the following tools could the analyst use?

NO.41 Which of the following are legally compliant forensics applications that will detect an alternative data stream (ADS) or a file with an incorrect file extension? (Choose two.)

NO.42 According to Payment Card Industry Data Security Standard (PCI DSS) compliance requirements, an organization must retain logs for what length of time?

NO.43 Which of the following technologies would reduce the risk of a successful SQL injection attack?

NO.44 Which common source of vulnerability should be addressed to BEST mitigate against URL redirection attacks?

NO.45 Which of the following data sources could provide indication of a system compromise involving the exfiltration of data to an unauthorized destination?

NO.46 An organization recently suffered a data breach involving a server that had Transmission Control Protocol (TCP) port 1433 inadvertently exposed to the Internet. Which of the following services was vulnerable?

NO.47 Which of the following is the FIRST step taken to maintain the chain of custody in a forensic investigation?

NO.48 Which of the following is susceptible to a cache poisoning attack?