QUESTION: 21

An administrator believes that a system on VLAN 12 is Address Resolution Protocol (ARP) poisoning clients on the network. The administrator attaches a system to VLAN 12 and uses Wireshark to capture traffic. After reviewing the capture file, the administrator finds no evidence of ARP poisoning.
Which of the following actions should the administrator take next?

Clear the ARP cache on their system.
Enable port mirroring on the switch.
Filter Wireshark to only show ARP traffic.
Configure the network adapter to promiscuous mode.

Answer(s): D

Reference:

https://www.tutorialspoint.com/ethical_hacking/ethical_hacking_arp_poisoning.htm

Reveal Solution Next Question

QUESTION: 22

A security investigator has detected an unauthorized insider reviewing files containing company secrets.
Which of the following commands could the investigator use to determine which files have been opened by this user?

ls
lsof
ps
netstat

Answer(s): B

Reveal Solution Next Question

QUESTION: 23

While performing routing maintenance on a Windows Server, a technician notices several unapproved Windows Updates and that remote access software has been installed. The technician suspects that a malicious actor has gained access to the system.
Which of the following steps in the attack process does this activity indicate?

Expanding access
Covering tracks
Scanning
Persistence

Answer(s): A

Reveal Solution Next Question

QUESTION: 24

Which of the following types of attackers would be MOST likely to use multiple zero-day exploits executed against high-value, well-defended targets for the purposes of espionage and sabotage?

Cybercriminals
Hacktivists
State-sponsored hackers
Cyberterrorist

Answer(s): C

Reveal Solution Next Question

Free CFR-410 Exam Braindumps (page: 6)

QUESTION: 21

Reference:

QUESTION: 22

QUESTION: 23

QUESTION: 24