CyberSec First Responder (CFR) (CFR-410) Exam Guide

1. 1.1Identify assets (applications, workstations, servers, appliances, operating systems, and others)
2. 1.2Identify factors that affect the tasking, collection, processing, exploitation, and dissemination architecture’s form and function
3. 1.3Identify and evaluate vulnerabilities and threat actors
4. 1.4Identify applicable compliance, standards, frameworks, and best practices for privacy
5. 1.5Identify applicable compliance, standards, frameworks, and best practices for security
6. 1.6Identify and conduct vulnerability assessment processes
7. 1.7Establish relationships between internal teams and external groups like law enforcement agencies and vendors

Example scenario: An Nmap sweep finds a host that is not in your asset inventory. What would you check before deciding whether it is a threat?

1. 2.1Analyze and report system security posture trends
2. 2.2Apply security policies to meet the system’s cybersecurity objectives and defend against cyber attacks and intrusions
3. 2.3Collaborate across internal and external organizational lines to enhance the collection, analysis, and dissemination of information
4. 2.4Employ approved defense-in-depth principles and practices
5. 2.5Develop and implement cybersecurity independent audit processes
6. 2.6Ensure that plans of action are in place for vulnerabilities identified during risk assessments, audits, and inspections
7. 2.7Protect organizational resources through security updates

Example scenario: A legacy server cannot be patched because a production system depends on it. What compensating controls would you use?

1. 3.1Analyze common indicators of potential compromise, anomalies, and patterns
2. 3.2Perform analysis of log files from various sources to identify possible threats to network security
3. 3.3Provide timely detection, identification, and alerting of possible attacks/ intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities
4. 3.4Take appropriate action to document and escalate incidents that may cause an ongoing and immediate impact on the environment

Example scenario: Windows security logs show hundreds of failed logons followed by one successful logon for the same account. What would you look at next?

1. 4.1Execute the incident response process
2. 4.2Collect and seize documentary or physical evidence and create a forensically sound duplicate that ensures the original evidence is not unintentionally modified to use for data recovery and analysis processes
3. 4.3Correlate incident data and create reports
4. 4.4Implement system security measures in accordance with established procedures
5. 4.5Determine tactics, techniques, and procedures (TTPs) of intrusion sets
6. 4.6Interface with internal teams and external organizations to ensure appropriate and accurate dissemination of incident information

Example scenario: A compromised workstation is about to be reimaged. What evidence should you capture first, and why does the order matter?

1. 5.1Implement recovery planning processes and procedures to restore systems and assets affected by cybersecurity incidents
2. 5.2Implement specific cybersecurity countermeasures for systems and applications
3. 5.3Review forensic images and other data sources for recovery of potentially relevant information
4. 5.4Provide advice and input for disaster recovery, contingency, and continuity of operations plans

Example scenario: Backups are ready, but you are not yet sure the attacker's persistence has been removed. What would you confirm before restoring service?