CFR-410 Practice Questions

The provided code executes a PowerShell command within an infinite loop (do...while(1)). The core of this loop is the shutdown command and a Start-Sleep cmdlet. The shutdown /r switch specifically instructs the operating system to reboot, not shut down. The /c switch displays the taunting message. The Start-Sleep –s 900 command pauses the script's execution for 900 seconds. Converting seconds to minutes (900 / 60) equals 15 minutes. Therefore, the script's intent is to display the message and initiate a system reboot every 15 minutes.

A. The shutdown command uses the /r switch, which explicitly means to reboot the computer, not shut it down.

C. This is incorrect on two points: the command is for a reboot (/r), and the interval is 15 minutes (900 seconds), not 900 minutes.

D. The time interval specified by Start-Sleep –s 900 is 900 seconds, which translates to 15 minutes, not 900 minutes.

1. Microsoft Corporation. (n.d.). Shutdown Command-Line Options. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown. (This document confirms that the /r parameter is used to "Restart the computer.")

2. Microsoft Corporation. (2023

July 27). Start-Sleep. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/start-sleep. (This official documentation specifies that the -s or -Seconds parameter "Specifies how long the resource sleeps in seconds.")

3. Purdue University. (n.d.). Malware and Malicious Code. Courseware for CS 42600 (Computer Security). Retrieved from https://www.cs.purdue.edu/homes/ninghui/courses/426Fall15/lectures/21-malware.pdf. (Page 4 discusses how malware

such as logic bombs

can execute payloads that include system commands like shutdown to disrupt operations

which is consistent with the scenario.)

Simple Network Management Protocol (SNMP) is used for managing and monitoring network devices. Exposing SNMP to the internet is a significant security vulnerability, as it can reveal sensitive information about a network's infrastructure, device configurations, and operational status. Attackers can leverage this information for detailed reconnaissance. Security best practices strongly recommend that access to management protocols like SNMP be restricted to trusted, internal management networks and that all SNMP traffic from the public internet be blocked at the perimeter firewall.

B. SMTP: Simple Mail Transfer Protocol is essential for sending and receiving email between servers. Blocking it would prevent an organization from receiving emails from the internet.

C. NTP: Network Time Protocol is used to synchronize system clocks. Accurate time is critical for logging, forensics, and cryptographic functions. Organizations often need to sync with external time sources.

D. POP3: Post Office Protocol version 3 is used by email clients to retrieve mail. While less common now, blocking it would prevent users who rely on it from accessing their email.

1. Cybersecurity and Infrastructure Security Agency (CISA). (2017). Securing Network Infrastructure Devices. CISA. In the section "Restrict and Secure Management Interfaces

" the guide explicitly states

"Block access to the management interface from the internet. Protocols such as HTTP

HTTPS

SNMP

SSH

and Telnet should not be accessible from the internet." This directly supports blocking SNMP at the firewall.

2. National Institute of Standards and Technology (NIST). (2008). NIST Special Publication 800-123: Guide to General Server Security. Section 5.6

"Secure Remote Administration

" page 5-11. The document advises that "all remote administration should be performed over a secure channel" and recommends restricting access to management networks

which implicitly supports blocking general internet access to management protocols like SNMP.

3. University of California

Berkeley. Security Best Practices: Network. Berkeley Information Security Office. The guidelines recommend to "Block all unneeded ports at the firewall" and specifically list SNMP (ports 161/162) as a protocol that is "commonly scanned for" and should be firewalled from the Internet unless there is a specific business need.

tcpdump is a command-line packet analyzer used for capturing and analyzing network traffic. Its primary function in a security context is to provide raw data for network forensics and incident response. By inspecting the contents, headers, sources, and destinations of packets, an analyst can identify anomalies that serve as Indicators of Compromise (IoC). These anomalies, such as traffic to or from known malicious IP addresses, data exfiltration patterns, command-and-control (C2) communications, or non-standard protocol usage, are collectively categorized as "unusual network traffic." Therefore, tcpdump is a fundamental tool for detecting this specific IoC.

B. tcpdump observes active traffic; it does not actively scan for open ports like tools such as nmap.

C. tcpdump can help diagnose the cause of poor performance (e.g., a flood), but it doesn't detect the performance issue itself.

D. While tcpdump can detect unknown protocols, this is a specific type of unusual network traffic, making option A more comprehensive.

---

1. Official Vendor Documentation: The official tcpdump man page describes its function as printing "a description of the contents of packets on a network interface." This capability is the foundation for observing traffic to identify any unusual or malicious activity.

Source: tcpdump(8) Linux manual page

available at tcpdump.org

Section: DESCRIPTION.

2. University Courseware: Course materials from reputable computer science programs demonstrate the use of tcpdump for security analysis. For example

labs often require students to analyze packet captures to find evidence of attacks

which constitutes identifying unusual network traffic.

Source: University of Washington

CSE 484 / CSE M 584: Computer Security

Lab 3: "Networking". The lab explicitly uses tcpdump and Wireshark to "examine network traffic to better understand how common network protocols work and see what information we can learn about network hosts." This analysis is key to finding anomalies.

3. Peer-reviewed Academic Publication: Academic literature on network forensics consistently identifies packet capture and analysis as a core methodology for detecting intrusions by identifying anomalous network traffic patterns.

Source: Al-Duwairi

B.

& Al-Karaki

J. (2011). A Network Forensic Analysis Tool for Tracking Intruders. International Journal of Computer Network and Information Security

3(1)

37-44. The paper discusses how packet capturing tools like tcpdump are essential for "collecting and analyzing network traffic data to detect security breaches" (Section 2.1

"Network Forensic Tools"). DOI: 10.5815/ijcnis.2011.01.05

In digital forensics, particularly when dealing with potentially malicious executables, binary analysis is crucial. The two primary and complementary techniques used are static and dynamic analysis. Static analysis involves examining the binary file without executing it, analyzing its code, strings, and structure to understand its potential functionality. Dynamic analysis involves running the binary in a controlled, isolated environment (a sandbox) to observe its actual behavior, such as network connections, file system modifications, and registry changes. Together, these methods provide a comprehensive understanding of a binary's purpose and impact.

A. Injection Analysis: This is a technique used in application security testing to find vulnerabilities (e.g., SQL injection), not a method for post-incident forensic analysis of a binary file.

B. Forensic Analysis: This is the broad discipline or process itself, not a specific technique for analyzing a binary. Static and dynamic analysis are techniques within the field of forensic analysis.

1. National Institute of Standards and Technology (NIST) Special Publication 800-83 Revision 1

Guide to Malware Incident Prevention and Handling for Desktops and Laptops. Section 4.3

"Malware Analysis

" states: "There are two primary approaches to analyzing malware: static and dynamic. Static analysis is the process of analyzing malware without executing it... Dynamic analysis is the process of analyzing malware by executing it on a host and observing its behavior."

2. Carnegie Mellon University

Software Engineering Institute (SEI)

Introduction to Malware Analysis Course. The course curriculum is fundamentally divided into the two core methodologies. The course description outlines modules on "Static Analysis" (disassembly

identifying code structures) and "Dynamic Analysis" (using sandboxes

monitoring system calls

network traffic). This structure is standard in academic and professional malware analysis training. (Reference: CMU SEI Course Catalog for Malware Analysis).

3. Sikorski

M.

& Honig

A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press. This book is a standard textbook in numerous university cybersecurity courses (e.g.

Johns Hopkins University EN.650.664 Malware Analysis). Part II (Chapters 5-10) is dedicated entirely to "Static Analysis

" and Part III (Chapters 11-18) is dedicated to "Dynamic Analysis

" establishing them as the foundational techniques of the field.

The scenario describes a classic phishing attack. Phishing is a form of social engineering where an attacker uses a fraudulent electronic communication, typically email, to masquerade as a trustworthy entity. The goal is to deceive the recipient into revealing sensitive information, such as login credentials or financial details. In this case, the attacker uses a deceptive email about a bank transaction to lure the user to a spoofed website designed to harvest their username and password. This method aligns perfectly with the definition of phishing.

A. Whaling: This is a more specific form of phishing that exclusively targets high-profile individuals like executives or senior management.

B. Smishing: This attack is a variant of phishing that uses SMS (text messages) as the delivery vector, not email.

C. Vishing: This attack, also known as voice phishing, uses voice communication (e.g., phone calls) to conduct the social engineering attack.

1. National Institute of Standards and Technology (NIST). (2023). Glossary of Information Security Terms. NIST Computer Security Resource Center.

Phishing: "A technique for attempting to acquire sensitive information

such as bank account numbers

through a fraudulent solicitation in email or on a web site

in which the perpetrator masquerades as a legitimate business or reputable person."

Whaling: "A type of phishing that targets a specific high-ranking or high-profile individual in an organization."

Smishing: "A type of phishing that uses Short Message Service (SMS) to send the bait."

Vishing: "A type of phishing that uses voice and the public-switched telephone network (PSTN) to conduct the attack."

2. Cichonski

P.

Millar

T.

Grance

T.

& Scarfone

K. (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61

Rev. 2). National Institute of Standards and Technology.

Section 3.4

Incident Categories: Describes social engineering attacks

including phishing

as a primary incident vector where attackers deceive users into providing information. The scenario is a textbook example of the incidents this guide addresses.

3. Khonji

M.

Iraqi

Y.

& Jones

A. (2013). Phishing Detection: A Literature Survey. IEEE Communications Surveys & Tutorials

15(4)

2091-2121.

Section II-A

Phishing Definition: This peer-reviewed article defines phishing as "a fraudulent attempt

usually made through email

to steal personal information." It further distinguishes it from vishing and smishing based on the communication channel used. (DOI: https://doi.org/10.1109/SURV.2013.032213.00067)

A firewall is a network security device situated at the perimeter, designed to monitor and control incoming and outgoing traffic based on a defined set of security rules. When a vulnerability assessment is conducted from an external source, the firewall's primary function is to block unsolicited and potentially malicious probes from the scanner. This action inherently skews the results by hiding internal systems and open ports, preventing the scanner from obtaining an accurate picture of the internal network's security posture. The scan report will reflect the hardened state of the firewall, not the true state of the devices behind it, leading to false negatives.

A. Access Point: An access point primarily provides wireless connectivity and is typically located inside the perimeter, not acting as the main filter for external scans.

B. Router: A router's main function is to forward traffic between networks. While it can perform basic filtering with ACLs, a firewall provides more comprehensive, stateful inspection.

D. IDS: An Intrusion Detection System (IDS) is a passive device that monitors and alerts on suspicious activity; it does not block traffic and therefore does not alter scan results.

E. Switch: A switch is an internal network device used to connect endpoints on a local network; it is not positioned at the perimeter to filter external traffic.

1. National Institute of Standards and Technology (NIST) Special Publication 800-115

Technical Guide to Information Security Testing and Assessment. Section 4.3

"Vulnerability Scanning

" explains that firewalls and routers can filter scanner traffic

which "can cause the scanner to produce inaccurate results

such as reporting that a host is not online or that a port is closed when it is actually open." This directly confirms that firewalls skew scan results.

2. National Institute of Standards and Technology (NIST) Special Publication 800-41 Rev. 1

Guidelines on Firewalls and Firewall Policy. Section 2.1

"What Is a Firewall?

" defines a firewall as a device that enforces an access control policy between networks. Its function of blocking traffic from untrusted networks (like the internet) is the mechanism by which it would skew an external vulnerability scan.

3. Carnegie Mellon University

Software Engineering Institute

CMU/SEI-2005-TN-023

Network Vulnerability Scanners. Section 2.2

"Limitations

" states

"Firewalls and intrusion detection systems can detect and/or block network scans

which can result in an incomplete or inaccurate vulnerability assessment." This academic source explicitly identifies firewalls as a primary cause of skewed scan results.

An attack surface represents the total number of points or vectors through which an attacker can attempt to enter or extract data from a system. Old or unused code, often referred to as "dead code," directly contributes to expanding this surface. This code is no longer maintained or tested as part of the active development lifecycle, yet it remains within the production environment. It can harbor unpatched vulnerabilities, outdated dependencies, or forgotten access points that an attacker could discover and exploit. By increasing the volume of code and potential entry points without active oversight, it enlarges the overall attack surface.

B. Vulnerability scanning: This is a defensive process used to identify and report on weaknesses within the existing attack surface, not to increase it.

C. Mapping of an attack surface: This is an analytical activity to document and understand the components of an attack surface, typically as a precursor to reducing it.

D. Penetration scanning: This is a method of testing the security of the current attack surface by simulating an attack; it does not add new components to it.

1. National Institute of Standards and Technology (NIST). (2021). Special Publication (SP) 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations. In the glossary (Appendix F)

an attack surface is defined as: "The set of points on the boundary of a system

a system element

or an environment where an attacker can try to enter

cause an effect on

or extract data from that system

system element

or environment." Old code provides such points.

2. OWASP Foundation. (2023). Attack Surface Analysis Cheat Sheet. This document outlines that a primary goal is to "reduce the attack surface." It identifies "The code in the application itself" as a core part of the surface. Logically

more code

especially unmaintained and unused code

increases the size and complexity of this surface.

3. Manadhata

P. K.

& Wing

J. M. (2011). An attack surface metric. IEEE Transactions on Software Engineering

37(3)

371-386. This foundational academic paper formalizes the concept of an attack surface. The authors state

"As a system evolves

its attack surface changes. For example

adding a feature might increase the attack surface..." Leaving old or unused code from previous features is a direct way the surface remains larger than necessary. (DOI: https://doi.org/10.1109/TSE.2010.60)

Traditional Security Information and Event Management (SIEM) systems are designed to provide a centralized view of an organization's security posture. Their fundamental, long-standing functions are to collect and aggregate log data from various network devices and systems. This data is then normalized into a common format for easier processing. The core value of a traditional SIEM lies in its correlation engine, which applies predefined rules to identify relationships between disparate events that may indicate a security incident. When a correlation rule is met, the system generates an alert to notify security personnel for further investigation. These four functions—Aggregation, Normalization, Correlation, and Alerting—form the foundational data processing pipeline of a traditional SIEM.

A: These are advanced features of User and Entity Behavior Analytics (UEBA) platforms, often integrated into next-generation SIEMs, not traditional ones.

C: These are specialized functions performed by malware analysis tools or sandboxes, which are separate technologies from SIEM.

D: These are core capabilities of Identity and Access Management (IAM) and Privileged Access Management (PAM) solutions, not SIEM systems.

1. National Institute of Standards and Technology (NIST). (2006). Special Publication 800-92

Guide to Computer Security Log Management.

Section 2.2

"Log Management Functions

" describes the key functions including log collection (aggregation)

parsing (a component of normalization)

and analysis (which encompasses correlation and alerting). This document outlines the foundational principles upon which SIEM technology is built.

2. Kent

K.

& Souppaya

M. (2006). Guide to Enterprise Telework

Remote Access

and Bring Your Own Device (BYOD) Security (NIST Special Publication 800-46 Revision 2). National Institute of Standards and Technology.

Section 5.3.2

"Security Information and Event Management

" states

"SIEM products provide the ability to gather security data from information system components... and to centralize the data to facilitate correlation and analysis for detecting trends and security events." This explicitly mentions the core functions.

3. Lund

M.

& Solms

S. V. (2011). A model for early warning and response to information security incidents. In Proceedings of the 10th European Conference on Information Warfare and Security (pp. 196-204). Academic Conferences International Limited.

This academic paper discusses the architecture of security systems

describing the SIEM process as involving the collection of events from sensors (aggregation)

filtering and normalization of data

and correlation to identify incidents

which then leads to alerts. This aligns directly with the functions listed in option B.

The objective is to gather the actual log entries ("supporting evidence") related to login failures for a specific date. The command grep 20151124 securitylog | grep "login" correctly performs this task in two stages. First, grep 20151124 securitylog filters the securitylog file for all lines containing the string for the correct date (November 24, 2015). Second, the output is piped (|) to grep "login", which further filters the results to show only the lines containing the term "login". This provides the analyst with all login-related events from that day, including the failures, which can then be reviewed as evidence.

A. The -c flag provides only a count of matching lines, not the actual log data needed for evidence.

B. This command searches for the incorrect date (20150124 is January 24) instead of the required November 24, 2015.

D. Similar to option A, the -c flag returns a numerical count instead of the log entries themselves.

1. GNU Grep 3.11 Manual

Section 2.1

"Command-line Options": The official documentation for grep specifies the function of the -c or --count option: "Suppress normal output; instead print a count of matching lines for each input file." This confirms that options A and D would not provide the evidentiary data required by the analyst.

2. MIT OpenCourseWare

6.005 Software Construction

Spring 2016

"Reading 1: Static Checking": In the section on "Pipes and filters

" the courseware explains the use of the pipe (|) operator to connect the output of one command to the input of another. It provides an example: ls | grep .java

which is analogous to the structure used in the question for filtering log data in stages. This validates the command's structure.

3. University of California

Berkeley

EECS Department

"CS 161: Computer Security

Fall 2020

Lab 0": This lab exercise instructs students on using command-line tools for security tasks. It demonstrates using grep to search for specific patterns in files and using pipes to combine commands for more complex filtering

which is the exact technique required to solve the problem posed in the question.

Technical compliance tests are designed to verify that IT systems are configured in accordance with established security policies and standards.

Performing vulnerability assessments and penetration testing (C) are active methods to test system configurations and security controls. Vulnerability scanning checks systems against databases of known vulnerabilities, which often result from misconfigurations, while penetration testing attempts to exploit such weaknesses. Both serve to verify if the system's security posture complies with policy objectives.

Implementing baseline configuration security controls (D) establishes a formal, documented standard for system settings. Compliance is then verified by regularly scanning systems and comparing their current state against this approved baseline, ensuring they have not deviated from the required secure configuration.

A. Implementing Automated Key Management Procedures: This is a specific control for managing cryptographic keys, not a general method for testing overall system configuration compliance.

B. Implementing Automated Human Resource Procedures: This relates to personnel security and administrative controls, not the technical configuration and compliance testing of IT systems.

1. NIST Special Publication 800-53 Rev. 5

Security and Privacy Controls for Information Systems and Organizations.

Control CM-2 (Baseline Configuration): This control requires organizations to develop and maintain a baseline configuration for systems. The discussion section notes

"Baseline configurations serve as a basis for future builds

releases

and/or changes to information systems...and for assessing the security state of systems." (Page 153)

Control RA-5 (Vulnerability Monitoring and Scanning): This control mandates scanning for vulnerabilities. This is a direct technical test to ensure the system complies with security requirements

such as being free from known configuration-related vulnerabilities. (Page 233)

Control CA-8 (Penetration Testing): This control requires penetration testing

which is described as a specialized type of assessment to identify vulnerabilities. This verifies the effectiveness of implemented controls against policy. (Page 149)

2. NIST Special Publication 800-128

Guide for Security-Focused Configuration Management of Information Systems.

Section 2.5 (Monitor and Report on the Security Configuration of Information Systems): This section explicitly states

"Monitoring involves checking and assessing information systems to determine if they are still in compliance with their documented secure configurations." This directly links monitoring/testing to baseline configuration compliance. (Page 13)

3. NIST Special Publication 800-115

Technical Guide to Information Security Testing and Assessment.

Section 1.2 (The Role of Security Testing and Examination): This section states that security testing and assessment "can be used to validate compliance with a specific security policy or other requirements." It further identifies vulnerability scanning and penetration testing as key assessment techniques. (Page 1-2)