Free CertNexus CFR-410 Exam Dumps Questions & Answers

Which of the following are core functions of SIEM solutions?

• A.  Alerts of potential attacks, forensic investigations, and incident detection.
• B.  Static malware analysis, dynamic malware analysis, and incident detection.
• C.  Malware analysis, forensic investigations, and incident detection.
• D.  Forensic investigations, threat modeling, and big data analysis.

The incident response team has completed root cause analysis for an incident. Which of the following actions should be taken in the next phase of the incident response process? (Choose two.)

• A.  Providing a briefing to management
• B.  Investigating responsible staff
• C.  Drafting a recovery plan for the incident
• D.  Training staff for future incidents
• E.  Updating policies and procedures

According to SANS, when should an incident retrospective be performed?

• A.  Within six months following the end of the incident.
• B.  After law enforcement has identified the perpetrators of the attack.
• C.  No later than two weeks from the end of the incident.
• D.  Immediately concluding eradication of the root cause

During which phase of the incident response process should an organization develop policies and procedures for incident handling?

• A.  Containment
• B.  Identification
• C.  Recovery
• D.  Preparation

An organization was recently hit with a ransomware attack that encrypted critical documents and files that were stored on the corporate file server.
Which of the following provides the organization with the BEST chance for recovering their data?

• A.  Application white listing!
• B.  Antivirus software
• C.  Offsite backups
• D.  Paying the ransom