Skip to content

CyberSec First Responder

Here you have the best CertNexus CFR-310 practice exam questions

  • Preview the first 5 of 100 questions for free
  • These questions were last updated on June 9, 2026
  • This site is not affiliated with or endorsed by CertNexus.
Question 1 of 100

A network security analyst has noticed a flood of Simple Mail Transfer Protocol (SMTP) traffic to internal clients. SMTP traffic should only be allowed to email servers. Which of the following commands would stop this attack? (Choose two.)

Answer

Suggested Answer

The suggested answer is A, C.

To address the issue of a flood of SMTP traffic to internal clients, the goal is to block unwanted SMTP traffic while allowing it only to designated email servers. The correct commands are: (1) iptables -A INPUT -p tcp –dport 25 -d x.x.x.x -j ACCEPT, which allows SMTP traffic to a specific email server, and (2) iptables -A INPUT -p tcp –dport 25 -j DROP, which blocks all other incoming SMTP traffic. These measures ensure that only legitimate email server communications are permitted while preventing the flood from affecting other internal clients.

Community Votes3 votes
ACSuggested
67%
CE
33%
Question 2 of 100

A secretary receives an email from a friend with a picture of a kitten in it. The secretary forwards it to the ~COMPANYWIDE mailing list and, shortly thereafter, users across the company receive the following message:

“You seem tense. Take a deep breath and relax!”

The incident response team is activated and opens the picture in a virtual machine to test it. After a short analysis, the following code is found in C:

\Temp\chill.exe:Powershell.exe –Command “do {(for /L %i in (2,1,254) do shutdown /r /m Error! Hyperlink reference not valid.> /f /t / 0 (/c “You seem tense. Take a deep breath and relax!”);Start-Sleep –s 900) } while(1)”

Which of the following BEST represents what the attacker was trying to accomplish?

Answer

Suggested Answer

The suggested answer is B.

The C code snippet provided in the question contains the 'shutdown /r /m' command, where the '/r' parameter specifies a reboot. The 'Start-Sleep -s 900' command indicates a sleep duration of 900 seconds. 900 seconds is equal to 15 minutes. Thus, the attacker aimed to taunt the user with a message and then trigger a reboot every 15 minutes.

Community Votes2 votes
BSuggested
50%
A
50%
Question 3 of 100

A Linux system administrator found suspicious activity on host IP 192.168.10.121. This host is also establishing a connection to IP 88.143.12.123. Which of the following commands should the administrator use to capture only the traffic between the two hosts?

Answer

Suggested Answer

The suggested answer is A.

To capture traffic specifically between two hosts, the correct command would involve specifying both hosts in the tcpdump filter. The command 'tcpdump -i eth0 host 88.143.12.123' will capture all traffic to and from 88.143.12.123. Since tcpdump interprets 'host' as capturing traffic where either the source or destination matches the given IP address, and considering that the command is issued from the host 192.168.10.121, it ensures that all interactions between 192.168.10.121 and 88.143.12.123 are captured.

Community Votes3 votes
ASuggested
67%
C
33%
Question 4 of 100

After imaging a disk as part of an investigation, a forensics analyst wants to hash the image using a tool that supports piecewise hashing. Which of the following tools should the analyst use?

Answer

Suggested Answer

The suggested answer is D.

To perform piecewise hashing, the analyst should use the tool 'hashdeep'. Hashdeep supports multiple hash functions and can perform piecewise hashing, which involves hashing large files by dividing them into smaller chunks. This feature is essential for forensic investigations to ensure data integrity and to manage large datasets efficiently.

Community Votes3 votes
DSuggested
67%
C
33%
Question 5 of 100

Which of the following is a cybersecurity solution for insider threats to strengthen information protection?

Answer

Suggested Answer

The suggested answer is B.

Data loss prevention (DLP) is a cybersecurity solution that focuses on preventing sensitive data from being accessed, used, or transmitted improperly, especially by insiders. DLP systems monitor data movements and can block unauthorized access or transfer of sensitive information, making it an effective solution for mitigating insider threats.

Community Votes2 votes
BSuggested
100%

95 more questions await

Unlock the full CertNexus CFR-310 question bank

5 of 100 completed5%

Choose your plan

Single payment · No subscription · No hidden fees

Standard

Quick preparation

$25

30 days access

30 day access to all questions
Instant free updates
Highest passing rate in industry
Printable PDF download
No money back guarantee
Best Value

Premium

Guaranteed success

$60$35

90 days access

PDF

Printable PDF download

New

Save every question as a PDF for offline study or printing.

90 day access to all questions
Instant free updates
Highest passing rate in industry
Pass guaranteed or money back

100% Money Back Guarantee

Don't pass? Full refund.

4.9/5

Based on 6,308+ reviews

Trusted by thousands of professionals

Join certified professionals who passed their exams with Examice

Examice helped me pass my AWS certification on the first try! The questions were incredibly similar to the real exam. Comments helped me understand answers I was struggling with.
S
Sarah C.
Cloud Engineer
Great results in a short prep time. Passed on my first attempt.
D
David K.
Network Engineer
I needed to pass an exam for work, and this website delivered. The quality for the price is outstanding, and the support is really good. I passed without issues.
M
Michael R.
Security Analyst
Skeptical at first, but impressed. Every question included clear, detailed explanations.
L
Lisa M.
Solutions Architect
The guarantee gave me confidence to invest in the premium package. Turns out I didn't need it. Passed comfortably. The explanations for each answer were incredibly detailed and helped me grasp security concepts that I'd been struggling with for months.
R
Robert H.
Cybersecurity Consultant
Used Examice for my PMP certification. The questions were well structured and covered all exam domains thoroughly.
J
James T.
IT Manager
After failing my first attempt with other study materials, I switched to Examice and passed confidently on my second attempt.
A
Anna W.
Data Engineer
The premium package was worth it. 90 days of access gave me the flexibility to study when it worked for me, without feeling rushed.
E
Emily J.
DevOps Engineer
Straightforward questions that matched the real exam perfectly. Studied for two weeks and passed with a great score.
K
Karen P.
Systems Administrator

Frequently Asked Questions

Everything you need to know. Contact us for more.

Our CertNexus CFR-310 questions are based on real exam experiences and are continuously updated to match the current exam format. Most candidates who study with us report passing on their first attempt, based on a self reported post exam survey.

With our Premium package, you get a 100% money back guarantee. If you don't pass your exam after studying with our materials, simply contact us with your exam results and we'll refund your purchase. Terms and conditions apply, read our full refund policy to learn more.

Our question bank is updated regularly based on feedback from recent exam takers. We typically review and update our content every week with reports about new questions or changes to the exam format.

Yes. When your access is close to expiring, you can renew it for another 30 days directly from the exam page. If you need more time while you are still preparing, reach out and we will help.

This is a single payment with no recurring charges. Once you purchase, you get full access to all exam questions for the duration of your package (30 days for Standard, 90 days for Premium). No hidden fees or automatic renewals.

Pass on your first try

All 100questions · Detailed explanations · Printable PDF · 90 days access

Money back guaranteeSecure checkout
$35

single payment