10 free CertNexus CFR-410 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 80 questions. Work through them, then open each answer to check your reasoning.
Get all 80 questions (US$39) · Download these 10 as a PDF
Question 1
A security analyst needs to capture network traffic from a compromised Mac host. They attempt to execute the tcpdump command using their general user account but continually receive an "Operation Not Permitted" error.
Use of which of the following commands will allow the analyst to capture traffic using tcpdump successfully?
Show answer and explanation
Correct answer: A. sudo
Unix-like systems because it needs direct access to network interfaces at the kernel level. The sudo command allows a user to execute a command with elevated privileges, bypassing the "Operation Not Permitted" error and enabling successful packet capture.
Why the other options are wrong
- B. netstat displays network statistics and connections but does not escalate privileges or enable packet capture functionality.
- C. chroot changes the root directory for a process but does not grant the elevated permissions required for tcpdump to access network interfaces.
- D. chmod changes file permissions but cannot elevate the user's privilege level to root, which is necessary for packet capture.
- E. lsof lists open files and processes but does not provide privilege escalation or direct capability to run tcpdump with required permissions.
Question 2
Which concept involves having more than one person required to complete a task?
Show answer and explanation
Correct answer: A. Separation of duties
Separation of duties is the security principle that requires multiple individuals to collaboratively complete sensitive tasks, preventing any single person from having complete control over critical processes. This prevents fraud, errors, and unauthorized actions by distributing responsibility across multiple parties.
Why the other options are wrong
- B. Mandatory access control is a model based on security labels and administrato-efined rules, not on requiring multiple people to complete tasks.
- C. Discretionary access control allows resource owners to determine access permissions but does not inherently require multiple people for task completion.
- D. Least privilege is the principle of granting users the minimum permissions necessary to perform their functions, independent of whether multiple people are involved.
Question 3
Which of the following regulations is most applicable to a public utility provider operating in the United States?
Show answer and explanation
Correct answer: B. NERC
NERC (North American Electric Reliability Corporation) standards apply specifically to electric utility providers and operators of the bulk electric system in the United States and Canada. Public utility providers must comply with NERC's Critical Infrastructure Protection (CIP) standards to maintain grid reliability and security.
Why the other options are wrong
- A. GDPR is the European Union's data protection regulation and does not specifically govern U.S. utility providers, though it may apply to EU data they process.
- C. FISMA applies to U.S. federal information systems and government agencies, not to private sector utility providers.
- D. HIPAA is specific to healthcare organizations and does not apply to public utility providers.
Question 4
Which approach to cybersecurity involves a series of defensive mechanisms that are layered to protect valuable data and information?
Show answer and explanation
Correct answer: B. Defense in depth
Defense in depth is the cybersecurity strategy that implements multiple layers of protective controls and defensive mechanisms. If one layer is breached, additional layers continue to protect the system, creating redundancy and significantly increasing the difficulty and cost of a successful attack.
Why the other options are wrong
- A. Network segmentation is a specific tactical control that divides networks into separate zones, not the overarching concept of layered defense.
- C. Tiered security is not a standard cybersecurity terminology; defense in depth is the correct term for layered protection strategies.
- D. Endpoint detection and response is a specific tool category for detecting threats on endpoints, not the broader concept of layered defensive mechanisms.
Question 5
Which standard was implemented in the United States to protect the privacy of patient medical information through restricted access to medical records and regulations for sharing medical records?
Show answer and explanation
Correct answer: D. HIPAA
HIPAA (Health Insurance Portability and Accountability Act) is the U.S. federal law specifically designed to protect the privacy and security of patient medical information. It establishes national standards for protecting health information, controlling access to medical records, and regulating how healthcare organizations can share sensitive patient data.
Why the other options are wrong
- A. NIST is the National Institute of Standards and Technology, which develops cybersecurity frameworks and standards but is not specific to medical privacy.
- B. GLBA (Gramm-Leach-Bliley Act) governs the financial services industry's handling of customer financial information, not healthcare data.
- C. SOX (Sarbanes-Oxley Act) applies to publicly traded companies and addresses financial reporting and corporate governance, not medical privacy.
Question 6
Which answer option is a tactic of social engineering in which an attacker engages in an attack performed by phone?
Show answer and explanation
Correct answer: C. Vishing
Vishing is a social engineering tactic where attackers impersonate legitimate entities and conduct attacks over the telephone to manipulate victims into divulging sensitive information or performing actions that compromise security. The term combines voice and phishing.
Why the other options are wrong
- A. Smishing is a social engineering attack conducted via SMS text messages, not phone calls.
- B. Pretexting is a social engineering technique where an attacker creates a fabricated scenario or false identity to establish trust, but it is not specifically limited to phon-ased attacks.
- D. Phishing is a social engineering attack primarily conducted via email or online platforms to trick users into revealing credentials or personal information.
Question 7
What describes the BEST approach for developing a plan to continuously assess and track vulnerabilities on all organizational assets and infrastructure in order to remediate and minimize the opportunity for attacks?
Show answer and explanation
Correct answer: A. Establish and maintain a risk-based remediation strategy.
A risk-based remediation strategy provides the framework for continuously assessing, tracking, and prioritizing vulnerabilities across organizational assets based on their potential impact and likelihood of exploitation. This approach enables systematic vulnerability remediation and minimizes attack opportunities by focusing resources on the highest-risk items first. While an asset inventory (B) is a prerequisite, it is not the primary plan for continuous assessment and remediation. Data classification (C) and data management processes (D) address data handling but not vulnerability tracking and remediation.
Why the other options are wrong
- B. Asset inventory is a supporting element but not the strategy itself for continuous vulnerability assessment and remediation.
- C. Data classification addresses information sensitivity, not vulnerability assessment and tracking.
- D. Data management processes govern data handling practices, not vulnerability remediation planning.
Question 8
An organization was recently hit with a ransomware attack that encrypted critical documents and files that were stored on the corporate file server.
Which of the following provides the organization with the BEST chance for recovering their data?
Show answer and explanation
Correct answer: D. Offsite backups
Offsite backups provide the best opportunity for data recovery after a ransomware attack because they are isolated from the infected network and retain clean copies of files prior to encryption. Application whitelisting (A) and antivirus software (B) are preventive controls that do not recover already-encrypted data. Paying the ransom (C) is unreliable, unethical, and may fund criminal activities without guaranteeing data recovery or safe decryption keys.
Why the other options are wrong
- A. Application whitelisting prevents malware execution but cannot recover data already encrypted by ransomware.
- B. Antivirus software may detect and remove ransomware but cannot decrypt files already encrypted.
- C. Paying ransoms is costly, unethical, and offers no guarantee of successful data recovery or legitimate decryption keys.
Question 9
Which of the following are components of Security Content Automation Protocol (SCAP)?
Show answer and explanation
Correct answer: C. CVE, CVSS, and OVAL
The Security Content Automation Protocol (SCAP) integrates multiple standards for vulnerability management and security assessment. CVE (Common Vulnerabilities and Exposures) provides standardized vulnerability identification. CVSS (Common Vulnerability Scoring System) offers standardized severity ratings for vulnerabilities. OVAL (Open Vulnerability and Assessment Language) enables the automated assessment and detection of security configurations and vulnerabilities. Option A is incorrect because CVM is not a SCAP component and NVD is a data source rather than a standard. Option B is incorrect because OSVDB is a legacy vulnerability database that is no longer maintained and is not a SCAP component. CWE and CWSS (D) relate to weakness classification rather than being primary SCAP components.
Why the other options are wrong
- A. CVM is not a SCAP component, and while NVD provides data, this combination is incorrect.
- B. OSVDB is a legacy database and not an official component of the SCAP framework.
- D. CWE and CWSS address weakness classification and scoring, not the core SCAP assessment automation components.
Question 10
Which term describes the process of collecting logs from many sources across an IT infrastructure into a single, centralized platform to be reviewed and analyzed?
Show answer and explanation
Correct answer: B. Log aggregation
Log aggregation is the specific process of collecting and consolidating logs from multiple sources across an IT infrastructure into a single, centralized platform for unified review and analysis. Log processing (A) involves transforming raw log data into usable formats. Log monitoring (C) refers to real-time observation and alerting on log events. Log normalization (D) converts logs from different sources into a consistent format. Log correlation (E) involves analyzing relationships between events across multiple logs. Only log aggregation accurately describes the collection and centralization function.
Why the other options are wrong
- A. Log processing transforms data but does not specifically describe centralizing logs from multiple sources.
- C. Log monitoring is the real-time observation of logs, not the collection and centralization process.
- D. Log normalization standardizes log formats but does not describe the aggregation and centralization function.
- E. Log correlation analyzes relationships between events, not the collection into a single platform.
That was 10 of 80.
The full CertNexus CFR-410 pack has all 80 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.