Free CFR-410 sample questions
Real questions from the Cybersec First Responder practice bank, with the correct answer and an explanation for each one. No junk, no filler.
Try them in the simulator Same questions, with study, timed and flashcard modes.
Showing 10 of 20 free sample questions.
During an incident, the response team determines that an attacker used PowerShell-based malware that executes entirely in memory, leaving minimal traces on the hard disk. Which forensic tool is essential for analyzing this type of attack?
During a forensic investigation, an analyst must create a bit-for-bit copy of a suspect's hard drive. To ensure the integrity of the original evidence is maintained, which of the following tools or techniques is essential?
During a post-incident review of a data exfiltration event, an analyst discovers that the attacker pivoted from a compromised web server to an internal database using credentials stored in a plaintext configuration file. The organization's policy mandates credential rotation every 90 days, but this had not been enforced. Which of the following countermeasures would be MOST effective in preventing a similar incident in the future?
An incident responder is analyzing a compromised Linux host. The attacker has attempted to cover their tracks. The responder needs to determine if the attacker modified critical system binaries like `/bin/ls` or `/bin/ps`. Which command should the responder use to verify the integrity of these files against a known-good database?
A manufacturing company is conducting a vulnerability assessment of its Industrial Control Systems (ICS) network. The assessment must identify vulnerabilities without disrupting the sensitive, real-time operations of the Programmable Logic Controllers (PLCs). Which scanning approach is MOST appropriate for this environment?
A security team is implementing a defense-in-depth strategy for their Active Directory environment to mitigate risks from compromised credentials. Which of the following controls should be implemented? (Select TWO).
True or False: In the context of evidence collection, a snapshot of a running virtual machine is considered a forensically sound duplicate of the live system's memory and disk.
An e-commerce company has experienced a security incident where customer PII was exposed. The After Action Report (AAR) identified a lack of timely detection as a key failure. The company's SIEM currently collects logs from firewalls and web servers but lacks endpoint context. To improve detection capabilities and address the AAR's findings, which log source should be integrated into the SIEM with the HIGHEST priority?
A first responder arrives at the scene of a suspected insider threat incident. An employee's workstation is powered on and logged in. The responder needs to preserve volatile memory for later analysis. What is the command-line tool of choice for capturing a full memory image on a live Windows system?
10 more free samples are waiting
Create a free account to unlock the whole CFR-410 sample bank, or get full access to all 212 practice questions in the simulator.