CFR-310 試験問題を無料オンラインアクセス

An administrator investigating intermittent network communication problems has identified an excessive amount of traffic from an external-facing host to an unknown location on the Internet. Which of the following BEST describes what is occurring?

• A.A malicious user is exporting sensitive data.
• B.Rogue hardware has been installed.
• C.An administrator has misconfigured a web proxy.
• D.The network is experiencing a denial of service (DoS) attack.

An incident at a government agency has occurred and the following actions were taken:
-Users have regained access to email accounts
-Temporary VPN services have been removed
-Host-based intrusion prevention system (HIPS) and antivirus (AV) signatures have been updated
-Temporary email servers have been decommissioned
Which of the following phases of the incident response process match the actions taken?

• A.Recovery
• B.Containment
• C.Identification
• D.Post-incident

During which phase of a vulnerability assessment would a security consultant need to document a requirement to retain a legacy device that is no longer supported and cannot be taken offline?

• A.Identifying critical assets
• B.Conducting post-assessment tasks
• C.Performing a vulnerability scan
• D.Determining scope

As part of an organization's regular maintenance activities, a security engineer visits the Internet Storm Center advisory page to obtain the latest list of blacklisted host/network addresses. The security engineer does this to perform which of the following activities?

• A.Update the latest proxy access list
• B.Monitor the organization's network for suspicious traffic
• C.Update access control list (ACL) rules for network devices
• D.Monitor the organization's sensitive databases

Which of the following is a method of reconnaissance in which a ping is sent to a target with the expectation of receiving a response?

• A.Network enumeration
• B.Passive scanning
• C.Application enumeration
• D.Active scanning