CFR-410 Exam Dumps : CyberSec First Responder (CFR) Exam

An administrator believes that a system on VLAN 12 is Address Resolution Protocol (ARP) poisoning clients on the network. The administrator attaches a system to VLAN 12 and uses Wireshark to capture traffic. After

reviewing the capture file, the administrator finds no evidence of ARP poisoning. Which of the following actions should the administrator take next?

A security analyst is required to collect detailed network traffic on a virtual machine. Which of the following tools could the analyst use?

A company that maintains a public city infrastructure was breached and information about future city projects was leaked. After the post-incident phase of the process has been completed, which of the following would be

PRIMARY focus of the incident response team?