During an incident response engagement, an analyst recovers a file containing NTLM hashes from a compromised Windows server. The analyst needs to recover plaintext passwords to check for reuse across other systems. The environment has no network connectivity to the compromised server. Which approach should the analyst use?

Run John the Ripper against the hash file with a wordlist and mangling rules

Use Wireshark to replay captured authentication packets to recover passwords

Use bettercap to sniff the network for password hashes in transit

Run Hydra against the server's SMB service using the recovered usernames

A network administrator discovers that a legacy FTP server transmits credentials and data in cleartext. An attacker on the same network could capture these credentials. Which mitigation would most directly address this vulnerability?

Implement strong password policies

Use Wireshark to monitor FTP traffic

What is the primary risk of transmitting data without encryption?

Data becomes corrupted during transmission

Data can be intercepted and read by unauthorized parties

Data is automatically deleted after transmission

Data is stored in a different format

What is the primary purpose of a phishing simulation campaign conducted by an organization?

To test the effectiveness of the organization's firewall and intrusion prevention system against malicious email attachments.

To collect credentials from employees for use in penetration testing of other systems.

To identify which employees are most likely to fall for social engineering and provide targeted security awareness training.

To measure the performance of the email gateway in blocking spam and malware.

Which attack is commonly enabled by ARP poisoning?

Man-in-the-middle (MITM) attack

CertNexusCyberSec First Responder (CFR)

Domain 1Objective 5

Objective 1.5 Exploiting Vulnerabilities in Systems. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 1)

Part of the 1.0 Attack Computing Environments to Test Cybersecurity domain, which accounts for 52% of the CYBERSEC-FIRST-RESPONDER exam.

67questions here

14free pages

26concepts

52%of the exam

26 Concepts in This Objective

Online password cracking
Offline password cracking
Credential sniffing
Backdoors
ARP poisoning/spoofing
DNS poisoning/spoofing
Session hijacking
DDoS attacks
Lack of or weak encryption
Lack of or weak access control
Poorly configured permissions
Misconfigurations in system files
Bots and botnets
Beaconing
C&C controllers
Python automation scripts
Bash automation scripts
Hydra
John the Ripper
Wordlists
Wireshark
TShark
Ettercap
bettercap
Pharming
Phishing

Questions 1–5

1application · medium
During an incident response engagement, an analyst recovers a file containing NTLM hashes from a compromised Windows server. The analyst needs to recover plaintext passwords to check for reuse across other systems. The environment has no network connectivity to the compromised server. Which approach should the analyst use?
Select an answer first
2application · medium
A network administrator discovers that a legacy FTP server transmits credentials and data in cleartext. An attacker on the same network could capture these credentials. Which mitigation would most directly address this vulnerability?
Select an answer first
3foundation · easy
What is the primary risk of transmitting data without encryption?
Select an answer first
4foundation · easy
What is the primary purpose of a phishing simulation campaign conducted by an organization?
Select an answer first
5foundation · easy
Which attack is commonly enabled by ARP poisoning?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSEC-FIRST-RESPONDER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CertNexus. “CYBERSEC-FIRST-RESPONDER” is a trademark of its owner, used for identification only.