CFR-210 試験問題を無料オンラインアクセス

A network engineer has collected a packet capture using Wireshark and given it to the team for analysis.
The team is looking for activity based on the internal IP address of 10.0.25.123. Which of the following
filters should the team use to look at only traffic for this IP?

• A.source tcp = 10.0.25.123 and destination tcp = 10.0.25.123
• B.source.ip == 10.0.25.123 && destination .ip == 10.0.25.123
• C.src.ip == 10.0.25.123 or dst.ip == 10.0.25.123
• D.src.ip = 10.0.25.123 or dst.ip = 10.0.25.123

An incident responder suspects that a host behind a firewall is infected with malware. Which of the
following should the responder use to find the IP address of the infected machine?

• A.NAT table
• B.DNS cache
• C.CAM cable
• D.ARP cache

A security auditor has been asked to analyze event logs to look for signs of suspicious behavior. The
company operated on a normal workday schedule (e.g., Monday through Friday, 8 am- 5 pm) and has
implemented stringent access control policies (e .g. password complexity, failed login attempts).
Which of the following provides the MOST reason for concern?

• A.Regularly occurring system calls taking place every day at midnight.
• B.15 failed login attempts taking place at 9 am.
• C.A single instance of failed read attempts on a protected directory structure.
• D.Two failed login attempts followed by a successful login in short succession.

An organization performs regular updates to its network devices to alert and prevent access to streaming
media sites by the employees. Each device will send logs and alerts to a centralized server for storage,
archive, and analysis. Which of the following BEST describes the system that is correlating the data found
in all alerts and logs?

• A.HIPS
• B.SIEM
• C.NIDS
• D.WIPS

Malicious code that can replicate itself using various techniques is referred to as a:

• A.rootkit
• B.launcher
• C.worm
• D.downloader