CFR-310 試験問題を無料オンラインアクセス

When performing an investigation, a security analyst needs to extract information from text files in a Windows operating system. Which of the following commands should the security analyst use?

• A.awk
• B.grep
• C.sigverif
• D.findstr

A security analyst has discovered that an application has failed to run. Which of the following is the tool MOST likely used by the analyst for the initial discovery?

• A.MSConfig
• B.Event Viewer
• C.Process Monitor
• D.syslog

An incident handler is assigned to initiate an incident response for a complex network that has been affected by malware. Which of the following actions should be taken FIRST?

• A.Isolate devices from the network.
• B.Capture network traffic for analysis.
• C.Make an incident response plan.
• D.Prepare incident response tools.

After imaging a disk as part of an investigation, a forensics analyst wants to hash the image using a tool that supports piecewise hashing. Which of the following tools should the analyst use?

• A.md5sum
• B.sha256sum
• C.md5deep
• D.hashdeep

During a malware-driven distributed denial of service attack, a security researcher found excessive requests to a name server referring to the same domain name and host name encoded in hexadecimal. The malware author used which type of command and control?

• A.Internet Relay Chat (IRC)
• B.File Transfer Protocol (FTP)
• C.Custom channel
• D.Dnscat2