Logical Operations CFR-210 問題集

質問 1：
An attack was performed on a company's web server, disabling the company's website. The incident
response team's investigation produced the following:
1 . Presence of malicious code installed on employees' workstations.
2 . Excessive UDP datagrams sent to a single address.
3 . Web server received excessive UDP datagrams from multiple internal hosts.
4 . Network experienced high traffic after 3:00pm .
5 . Employee workstations sent large traffic bursts when employees accessed the internal timecard
application.
Which of the following BEST describes the attack tool used to perform the attack?
A. Logic bomb
B. Keylogger
C. Metasploit
D. Nessus
正解：C

質問 2：
Organizations should exercise their Incident Response (IR) plan following initial creation. The primary
objective for this first I R plan exercise is to identify:
A. gaps or overlaps in supporting processes and procedures.
B. deficiencies in cyber security incident response team skills.
C. capabilities required to improve response time.
D. critical steps required in the case of an incident.
正解：C

質問 3：
An outside organization has reported to the Chief Information Officer (CIO) of a company that it has
received attack from a Linux system in the company's DMZ. Which of the following commands should an
incident responder use to review a list of currently running programs on the potentially compromised
system?
A. task manager
B. tlist
C. top
D. who
正解：C

質問 4：
A user reports a pop-up error when starting a Windows machine. The error states that the machine has
been infected with a virus and instructs the user to download a new antivirus client. In which of the
following locations should the incident responder check to find what is generating the error message?
(Choose two.)
A. Programs and Features
B. Auto-start registry keys
C. Browser history
D. Device Manager
E. Event Viewer
正解：B,E

質問 5：
Which of the following logs should be checked to determine if an internal user connected to a potentially
malicious website? (Choose two.)
A. FTP logs
B. Proxy logs
C. Firewall logs
D. Email logs
E. HTTP logs
正解：B,E

質問 6：
A company website was hacked via the SQL query below:

Which of the following did the hackers perform?
A. Deleted the email password and login details
B. Performed an XSS attack
C. Deleted the entire members table
D. Cleared tracks of [email protected] entries
正解：B

質問 7：
An organization's firewall has recently been bombarded with an excessive amount of failed requests.
A security analyst has been tasked with providing metrics on any failed attempts to ports above 1000.
Which of the following regular expressions will work BEST to identify an IP address with the desired port
range?
A. /\bA(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):({4,5}\d+)\b/
B. /\bA(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):([4]\d+)\b/
C. /\bA(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):((4]\D+)\b/
D. /\bA(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):(\d{1,5})\b/
正解：B

質問 8：
Which of the following are reasons that a hacker would execute a DoS or a DDoS attack? (Choose two.)
A. To promote business operations
B. To determine network bandwidth
C. To distract the remediation team
D. To distract the incident response team
E. To compromise a system and reuse the IP address
正解：B,D