Logical Operations Exam CFR-210 Topic 1 Question 69 Discussion

Actual exam question for Logical Operations's CFR-210 exam

Question #: 69
Topic #: 1

A DMZ web server has been compromised. During the log review, the incident responder wants to parse all common internal Class A addresses from the log. Which of the following commands should the responder use to accomplish this?

Agrep --x''(10.[0-9]+.[0-9]+.[0-9]+)'' etc/rc.d/apache2/access.log | output.txt

Bgrep --x''(192.168.[0.9]+[0-9])'' bin/apache2/access.log | output.txt

Cgrep --v''(10.[0-9]+.[0-9]+.[0-9]+)'' /var/log/apache2/access.log > output.txt

Dgrep --v''(192.168.[0.9]+[0-9]+)'' /var/log/apache2/access.log > output.txt

Show Suggested Answer

Suggested Answer: C

by Alease at Jul 13, 2024, 07:20 PM

Limited Time Offer

25%

Off

Get Premium CFR-210 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Peggie

4 months ago

Haha, this question is a classic. It's like they're trying to trick us with all these similar-looking IP address patterns. I'm going to go with option C, just to mess with them. You know, keep them on their toes.

upvoted 0 times

...

Hillary

4 months ago

Hold up, what's with all these IP address ranges? I thought we were supposed to be good at this cybersecurity stuff, not network engineering. I'm going to go with option B and hope for the best.

upvoted 0 times

Malcom

3 months ago

Yeah, I agree. Option B looks like the right choice to filter out those Class A addresses from the log.

upvoted 0 times

...

Leatha

3 months ago

Don't worry, it's all part of the cybersecurity game. We need to be able to identify internal IP addresses to track down the compromise.

upvoted 0 times

...

Doretha

4 months ago

I can't believe they're asking us to parse log files in an exam! That's like, real-world stuff, not what I signed up for. Anyway, I'm going with option D. It just feels right, you know?

upvoted 0 times

Brandon

3 months ago

I agree with you, option D does feel like the right answer in this situation.

upvoted 0 times

...

Ocie

4 months ago

I'm not sure, I feel like option C might be the better choice here.

upvoted 0 times

...

Josphine

4 months ago

I think option D is the way to go too. It seems like the most logical choice.

upvoted 0 times

...

Merlyn

4 months ago

That makes sense, thanks for explaining.

upvoted 0 times

...

Marti

4 months ago

Because it uses the correct syntax to exclude Class A addresses.

upvoted 0 times

...

Merlyn

4 months ago

Why do you think option C is correct?

upvoted 0 times

...

Marti

4 months ago

I disagree, I believe option C is the right one.

upvoted 0 times

...

Merlyn

4 months ago

I think the correct command is option A.

upvoted 0 times

...

Serina

5 months ago

Hmm, I'm not sure about that. Shouldn't we be using the `--x` flag instead of `--v` to extract the internal Class A addresses? I think option A might be the better choice here.

upvoted 0 times

...

Jodi

5 months ago

Option C seems like the way to go. The `--v` flag in the grep command will allow us to exclude the internal Class A addresses, which is exactly what the incident responder needs.

upvoted 0 times

Alita

4 months ago

That's right, option C will help parse out the common internal Class A addresses effectively.

upvoted 0 times

...

Freeman

4 months ago

Using the --v flag will exclude the internal Class A addresses from the log.

upvoted 0 times

...

Isaac

4 months ago

I agree, option C with the --v flag looks like the best choice.

upvoted 0 times

...