Free CertNexus CFR-410 Practice Questions
20 free CertNexus CFR-410 practice questions from the CertStash pack of 80, each with the correct answer and a full explanation.
Question 1
A security analyst needs to capture network traffic from a compromised Mac host. They attempt to execute the tcpdump command using their general user account but continually receive an "Operation Not Permitted" error. Use of which of the following commands will allow the analyst to capture traffic using tcpdump successfully?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
tcpdump requires root privileges to capture network traffic on Unix-like systems because it needs direct access to network interfaces at the kernel level. The sudo command allows a user to execute a command with elevated privileges, bypassing the "Operation Not Permitted" error and enabling successful packet capture.
Not this one. Try another answer.
Why B is wrong
netstat displays network statistics and connections but does not escalate privileges or enable packet capture functionality.
Not this one. Try another answer.
Why C is wrong
chroot changes the root directory for a process but does not grant the elevated permissions required for tcpdump to access network interfaces.
Not this one. Try another answer.
Why D is wrong
chmod changes file permissions but cannot elevate the user's privilege level to root, which is necessary for packet capture.
Not this one. Try another answer.
Why E is wrong
lsof lists open files and processes but does not provide privilege escalation or direct capability to run tcpdump with required permissions.
Question 2
Which are successful Disaster Recovery Plan best practices options to be considered? (Choose three.)
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
Successful disaster recovery practices require isolating services and data to limit blast radius (A), identifying and prioritizing critical business processes that must continue operating during recovery (C), and maintaining consistency between primary and secondary systems to ensure smooth failover and data integrity (D). Option B is poor practice, because a backup that is always attached creates a single point of failure, and option E violates security principles by storing sensitive data in root storage accessible via root credentials.
Not this one. Try another answer.
Why B is wrong
Continuous 24/7 attachment of backup storage creates a single point of failure and makes backups vulnerable to the same attacks compromising primary systems.
Right, C is one of the answers.
Why C is right
Successful disaster recovery practices require isolating services and data to limit blast radius (A), identifying and prioritizing critical business processes that must continue operating during recovery (C), and maintaining consistency between primary and secondary systems to ensure smooth failover and data integrity (D). Option B is poor practice, because a backup that is always attached creates a single point of failure, and option E violates security principles by storing sensitive data in root storage accessible via root credentials.
Right, D is one of the answers.
Why D is right
Successful disaster recovery practices require isolating services and data to limit blast radius (A), identifying and prioritizing critical business processes that must continue operating during recovery (C), and maintaining consistency between primary and secondary systems to ensure smooth failover and data integrity (D). Option B is poor practice, because a backup that is always attached creates a single point of failure, and option E violates security principles by storing sensitive data in root storage accessible via root credentials.
Not this one. Try another answer.
Why E is wrong
Storing data elements in root-accessible storage violates the principle of least privilege and creates significant security risks by making sensitive data available to root users.
Question 3
Which concept involves having more than one person required to complete a task?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Separation of duties is the security principle that requires multiple individuals to collaboratively complete sensitive tasks, preventing any single person from having complete control over critical processes. This prevents fraud, errors, and unauthorized actions by distributing responsibility across multiple parties.
Not this one. Try another answer.
Why B is wrong
Mandatory access control is a model based on security labels and administrator-defined rules, not on requiring multiple people to complete tasks.
Not this one. Try another answer.
Why C is wrong
Discretionary access control allows resource owners to determine access permissions but does not inherently require multiple people for task completion.
Not this one. Try another answer.
Why D is wrong
Least privilege is the principle of granting users the minimum permissions necessary to perform their functions, independent of whether multiple people are involved.
Question 4
Which of the following regulations is most applicable to a public utility provider operating in the United States?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
GDPR is the European Union's data protection regulation and does not specifically govern U.S. utility providers, though it may apply to EU data they process.
Right, B is the answer.
Why B is right
NERC (North American Electric Reliability Corporation) standards apply specifically to electric utility providers and operators of the bulk electric system in the United States and Canada. Public utility providers must comply with NERC's Critical Infrastructure Protection (CIP) standards to maintain grid reliability and security.
Not this one. Try another answer.
Why C is wrong
FISMA applies to U.S. federal information systems and government agencies, not to private sector utility providers.
Not this one. Try another answer.
Why D is wrong
HIPAA is specific to healthcare organizations and does not apply to public utility providers.
Question 5
Which approach to cybersecurity involves a series of defensive mechanisms that are layered to protect valuable data and information?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Network segmentation is a specific tactical control that divides networks into separate zones, not the overarching concept of layered defense.
Right, B is the answer.
Why B is right
Defense in depth is the cybersecurity strategy that implements multiple layers of protective controls and defensive mechanisms. If one layer is breached, additional layers continue to protect the system, creating redundancy and significantly increasing the difficulty and cost of a successful attack.
Not this one. Try another answer.
Why C is wrong
Tiered security is not a standard cybersecurity terminology; defense in depth is the correct term for layered protection strategies.
Not this one. Try another answer.
Why D is wrong
Endpoint detection and response is a specific tool category for detecting threats on endpoints, not the broader concept of layered defensive mechanisms.
Question 6
Vulnerability scanners generally classify vulnerabilities by which of the following? (Choose two.)
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
Vulnerability scanners classify vulnerabilities primarily by severity level (Critical, High, Medium, Low) and by exploit range (local, adjacent network, network), which help organizations prioritize remediation efforts based on risk and accessibility. These classifications guide security teams in determining which vulnerabilities pose the greatest threat and require immediate attention.
Not this one. Try another answer.
Why B is wrong
Vulnerability scanners do not typically classify vulnerabilities by financial costs, as cost is not an inherent property of the vulnerability itself.
Right, C is one of the answers.
Why C is right
Vulnerability scanners classify vulnerabilities primarily by severity level (Critical, High, Medium, Low) and by exploit range (local, adjacent network, network), which help organizations prioritize remediation efforts based on risk and accessibility. These classifications guide security teams in determining which vulnerabilities pose the greatest threat and require immediate attention.
Not this one. Try another answer.
Why D is wrong
Zero days are a category of unknown vulnerabilities, and scanners cannot classify vulnerabilities as zero days since they work with known, documented vulnerabilities in their databases.
Not this one. Try another answer.
Why E is wrong
Threat modeling is a separate security methodology used to identify and prioritize threats to systems, not a classification method used by vulnerability scanners.
Question 7
Which standard was implemented in the United States to protect the privacy of patient medical information through restricted access to medical records and regulations for sharing medical records?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
NIST is the National Institute of Standards and Technology, which develops cybersecurity frameworks and standards but is not specific to medical privacy.
Not this one. Try another answer.
Why B is wrong
GLBA (Gramm-Leach-Bliley Act) governs the financial services industry's handling of customer financial information, not healthcare data.
Not this one. Try another answer.
Why C is wrong
SOX (Sarbanes-Oxley Act) applies to publicly traded companies and addresses financial reporting and corporate governance, not medical privacy.
Right, D is the answer.
Why D is right
HIPAA (Health Insurance Portability and Accountability Act) is the U.S. federal law specifically designed to protect the privacy and security of patient medical information. It establishes national standards for protecting health information, controlling access to medical records, and regulating how healthcare organizations can share sensitive patient data.
Question 8
Which answer option is a tactic of social engineering in which an attacker engages in an attack performed by phone?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Smishing is a social engineering attack conducted via SMS text messages, not phone calls.
Not this one. Try another answer.
Why B is wrong
Pretexting is a social engineering technique where an attacker creates a fabricated scenario or false identity to establish trust, but it is not specifically limited to phone-based attacks.
Right, C is the answer.
Why C is right
Vishing is a social engineering tactic where attackers impersonate legitimate entities and conduct attacks over the telephone to manipulate victims into divulging sensitive information or performing actions that compromise security. The term combines voice and phishing.
Not this one. Try another answer.
Why D is wrong
Phishing is a social engineering attack primarily conducted via email or online platforms to trick users into revealing credentials or personal information.
Question 9
Which three answer options are password attack methods and techniques? (Choose three.)
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Cross-Site Scripting is a code injection vulnerability, not a password attack method.
Right, B is one of the answers.
Why B is right
Brute force attacks systematically try all possible password combinations until the correct one is found. Dictionary attacks use precompiled lists of common words and passwords to attempt unauthorized access. Hybrid attacks combine dictionary words with numbers and special characters to increase effectiveness. Cross-Site Scripting (XSS) is a web application vulnerability that injects malicious scripts into webpages, not a password attack. Man-in-the-middle attacks intercept communications between two parties but are not specifically password attack techniques.
Not this one. Try another answer.
Why C is wrong
Man-in-the-middle attacks intercept network communications but are not direct password attack techniques.
Right, D is one of the answers.
Why D is right
Brute force attacks systematically try all possible password combinations until the correct one is found. Dictionary attacks use precompiled lists of common words and passwords to attempt unauthorized access. Hybrid attacks combine dictionary words with numbers and special characters to increase effectiveness. Cross-Site Scripting (XSS) is a web application vulnerability that injects malicious scripts into webpages, not a password attack. Man-in-the-middle attacks intercept communications between two parties but are not specifically password attack techniques.
Right, E is one of the answers.
Why E is right
Brute force attacks systematically try all possible password combinations until the correct one is found. Dictionary attacks use precompiled lists of common words and passwords to attempt unauthorized access. Hybrid attacks combine dictionary words with numbers and special characters to increase effectiveness. Cross-Site Scripting (XSS) is a web application vulnerability that injects malicious scripts into webpages, not a password attack. Man-in-the-middle attacks intercept communications between two parties but are not specifically password attack techniques.
Question 10
What describes the BEST approach for developing a plan to continuously assess and track vulnerabilities on all organizational assets and infrastructure in order to remediate and minimize the opportunity for attacks?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A risk-based remediation strategy provides the framework for continuously assessing, tracking, and prioritizing vulnerabilities across organizational assets based on their potential impact and likelihood of exploitation. This approach enables systematic vulnerability remediation and minimizes attack opportunities by focusing resources on the highest-risk items first. While an asset inventory (B) is a prerequisite, it is not the primary plan for continuous assessment and remediation. Data classification (C) and data management processes (D) address data handling but not vulnerability tracking and remediation.
Not this one. Try another answer.
Why B is wrong
Asset inventory is a supporting element but not the strategy itself for continuous vulnerability assessment and remediation.
Not this one. Try another answer.
Why C is wrong
Data classification addresses information sensitivity, not vulnerability assessment and tracking.
Not this one. Try another answer.
Why D is wrong
Data management processes govern data handling practices, not vulnerability remediation planning.
What people say about the full CFR-410 pack 5.0 from 1
I wasn’t sure if I’d be able to pass, but the study material was clear and helped me understand everything better. After practicing, I felt well-prepared and passed without issue.
Question 11
Which two mitigation strategies can prevent an attack delivered via malware? (Choose two.)
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Daily backups enable recovery after a malware attack but do not prevent the attack from occurring.
Right, B is one of the answers.
Why B is right
Raising user awareness (B) prevents malware infection by training users to recognize phishing, malicious attachments, and social engineering tactics. Application patching (D) eliminates known vulnerabilities that malware exploits to gain entry or execute. Together, these directly prevent malware delivery and execution at the source.
Not this one. Try another answer.
Why C is wrong
IDS detects malware activity after it has already compromised the system, providing detection rather than prevention.
Right, D is one of the answers.
Why D is right
Raising user awareness (B) prevents malware infection by training users to recognize phishing, malicious attachments, and social engineering tactics. Application patching (D) eliminates known vulnerabilities that malware exploits to gain entry or execute. Together, these directly prevent malware delivery and execution at the source.
Not this one. Try another answer.
Why E is wrong
Multi-factor authentication protects account access but does not prevent malware installation or execution on systems.
Question 12
A system administrator pulls records from a database that only requires the use of their general user vs. domain admin account. Use of the general user account demonstrates which of the following concepts?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Discretionary Access Control refers to the model allowing resource owners to set permissions, not the principle of minimal access.
Not this one. Try another answer.
Why B is wrong
Separation of Duties divides critical functions among multiple individuals to prevent fraud, which is not what this scenario illustrates.
Right, C is the answer.
Why C is right
Least privilege is the practice of granting users only the minimum access rights necessary to perform their job functions. A system administrator pulling database records with a general user account instead of a privileged domain admin account directly demonstrates this principle; they are using the minimum required access level rather than elevated permissions.
Not this one. Try another answer.
Why D is wrong
Privileged Access Management is a framework for managing high-privilege accounts, whereas this scenario shows restraint from using privilege when unnecessary.
Question 13
Which part of a proactive approach to system security is responsible for identifying all possible threats to a system to be categorized and analyzed?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Threat assessment evaluates the severity and likelihood of known threats but does not systematically identify all possible threats.
Not this one. Try another answer.
Why B is wrong
Threat intelligence gathers information about existing threats and threat actors from external sources, rather than modeling potential threats to a specific system.
Right, C is the answer.
Why C is right
Threat modeling is the systematic process of identifying all possible threats to a system, categorizing them by type and likelihood, and analyzing their potential impact. This is the foundational proactive security activity that discovers and catalogs threats before defensive measures are designed and implemented.
Not this one. Try another answer.
Why D is wrong
Threat hunting actively searches for evidence of threats already present in a system, a reactive rather than proactive approach.
Question 14
Which of the following digital forensic goals is being provided with hashing and time-stamping of the electronic evidence?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Confidentiality protects data from unauthorized disclosure, which is not the purpose of hashing and time-stamping.
Not this one. Try another answer.
Why B is wrong
Encryption is a separate security control; hashing and time-stamping do not provide encryption.
Right, C is the answer.
Why C is right
Hashing and time-stamping of electronic evidence provides integrity assurance in digital forensics. Hashing creates a unique fingerprint of data that detects any unauthorized or accidental modifications, while time-stamping documents when evidence was collected and processed. Together, these techniques ensure the evidence remains unaltered and trustworthy throughout the forensic investigation.
Not this one. Try another answer.
Why D is wrong
Availability ensures data is accessible when needed, not the goal of these forensic techniques.
Not this one. Try another answer.
Why E is wrong
Chain of custody documents the handling and custody of evidence, while hashing and time-stamping specifically verify integrity of the evidence itself.
Question 15
During which phase of the incident response process should an organization develop policies and procedures for incident handling?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Containment is the phase where active response to a detected incident occurs, not where policies are developed.
Right, B is the answer.
Why B is right
The Preparation phase is the correct phase during which an organization develops and establishes policies, procedures, and response playbooks for incident handling. This proactive phase occurs before incidents happen and includes creating incident response teams, defining roles and responsibilities, establishing communication protocols, and documenting procedures. The other phases (Identification, Containment, Recovery) are reactive and occur during or after an incident has been detected.
Not this one. Try another answer.
Why C is wrong
Identification is when an incident is first detected and confirmed, not when foundational policies are created.
Not this one. Try another answer.
Why D is wrong
Recovery is the final phase focused on restoring systems to normal operations, not developing initial procedures.
Question 16
What is baseline security?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This describes the measurement of changes from the baseline, not what a baseline itself is.
Not this one. Try another answer.
Why B is wrong
An insecure starting point describes the problem state before remediation, not the baseline which is established after fixes are applied.
Right, C is the answer.
Why C is right
A baseline security is an organization's secure starting point established after fixing any security issues. It serves as a reference point against which all future changes and configurations are measured to ensure the system maintains its secure state. This baseline allows organizations to detect deviations and unauthorized modifications that could compromise security.
Not this one. Try another answer.
Why D is wrong
This describes an acceptable use policy or terms of service agreement, not a baseline security configuration.
Question 17
An organization was recently hit with a ransomware attack that encrypted critical documents and files that were stored on the corporate file server. Which of the following provides the organization with the BEST chance for recovering their data?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Application whitelisting prevents malware execution but cannot recover data already encrypted by ransomware.
Not this one. Try another answer.
Why B is wrong
Antivirus software may detect and remove ransomware but cannot decrypt files already encrypted.
Not this one. Try another answer.
Why C is wrong
Paying ransoms is costly, unethical, and offers no guarantee of successful data recovery or legitimate decryption keys.
Right, D is the answer.
Why D is right
Offsite backups provide the best opportunity for data recovery after a ransomware attack because they are isolated from the infected network and retain clean copies of files prior to encryption. Application whitelisting (A) and antivirus software (B) are preventive controls that do not recover already-encrypted data. Paying the ransom (C) is unreliable, unethical, and may fund criminal activities without guaranteeing data recovery or safe decryption keys.
Question 18
Which three of the following are included in encryption architecture? (Choose three.)
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A certificate is used to bind an identity to a public key and facilitate secure key exchange, but it is not one of the core structural components of the encryption architecture itself.
Right, B is one of the answers.
Why B is right
An encryption architecture is built from three fundamental components that work together to protect information: the data itself, which is the asset requiring confidentiality; the encryption engine, which is the cryptographic mechanism or software/hardware module that performs the actual encryption and decryption operations; and the encryption keys, which are managed through key management processes and are essential for both encrypting and decrypting the data. Together, these three elements form the complete functional structure of any encryption solution, regardless of the specific algorithm or use case being implemented.
Right, C is one of the answers.
Why C is right
An encryption architecture is built from three fundamental components that work together to protect information: the data itself, which is the asset requiring confidentiality; the encryption engine, which is the cryptographic mechanism or software/hardware module that performs the actual encryption and decryption operations; and the encryption keys, which are managed through key management processes and are essential for both encrypting and decrypting the data. Together, these three elements form the complete functional structure of any encryption solution, regardless of the specific algorithm or use case being implemented.
Not this one. Try another answer.
Why D is wrong
Database encryption is a specific application or implementation of encryption architecture in a particular context, not a foundational component of the architecture itself.
Right, E is one of the answers.
Why E is right
An encryption architecture is built from three fundamental components that work together to protect information: the data itself, which is the asset requiring confidentiality; the encryption engine, which is the cryptographic mechanism or software/hardware module that performs the actual encryption and decryption operations; and the encryption keys, which are managed through key management processes and are essential for both encrypting and decrypting the data. Together, these three elements form the complete functional structure of any encryption solution, regardless of the specific algorithm or use case being implemented.
Question 19
Which term describes the process of collecting logs from many sources across an IT infrastructure into a single, centralized platform to be reviewed and analyzed?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Log processing transforms data but does not specifically describe centralizing logs from multiple sources.
Right, B is the answer.
Why B is right
Log aggregation is the specific process of collecting and consolidating logs from multiple sources across an IT infrastructure into a single, centralized platform for unified review and analysis. Log processing (A) involves transforming raw log data into usable formats. Log monitoring (C) refers to real-time observation and alerting on log events. Log normalization (D) converts logs from different sources into a consistent format. Log correlation (E) involves analyzing relationships between events across multiple logs. Only log aggregation accurately describes the collection and centralization function.
Not this one. Try another answer.
Why C is wrong
Log monitoring is the real-time observation of logs, not the collection and centralization process.
Not this one. Try another answer.
Why D is wrong
Log normalization standardizes log formats but does not describe the aggregation and centralization function.
Not this one. Try another answer.
Why E is wrong
Log correlation analyzes relationships between events, not the collection into a single platform.
Question 20
Which of the following tools can help to detect suspicious or unauthorized changes to critical system configuration files?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Tripwire is a file integrity monitoring tool specifically designed to detect unauthorized or suspicious changes to critical system files. It creates cryptographic checksums of files and alerts administrators when those files are modified, making it ideal for detecting configuration file tampering and unauthorized system changes.
Not this one. Try another answer.
Why B is wrong
Logstash is a log processing and aggregation tool, not a file integrity monitoring solution.
Not this one. Try another answer.
Why C is wrong
Nessus is a vulnerability scanner that identifies security weaknesses, not a tool for monitoring file changes.
Not this one. Try another answer.
Why D is wrong
Netcat is a network utility tool used for network communication and troubleshooting, not file integrity monitoring.
Not this one. Try another answer.
Why E is wrong
Ifconfig is a network configuration utility for viewing and configuring network interfaces, not a file integrity tool.
About the CFR-410 exam
The rule is the same for every exam: ten free on the product page, 20 free here, all 80 in the pack, and each step includes the one before it.
That was 20 of 80.
The full CertNexus CFR-410 pack has all 80 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free updates for life and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 40 free as one PDF by email. Get the free PDF →
