Logical Operations Exam CFR-210 Topic 1 Question 69 Discussion

Actual exam question for Logical Operations's CFR-210 exam

Question #: 69
Topic #: 1

A DMZ web server has been compromised. During the log review, the incident responder wants to parse all common internal Class A addresses from the log. Which of the following commands should the responder use to accomplish this?

Agrep --x''(10.[0-9]+.[0-9]+.[0-9]+)'' etc/rc.d/apache2/access.log | output.txt

Bgrep --x''(192.168.[0.9]+[0-9])'' bin/apache2/access.log | output.txt

Cgrep --v''(10.[0-9]+.[0-9]+.[0-9]+)'' /var/log/apache2/access.log > output.txt

Dgrep --v''(192.168.[0.9]+[0-9]+)'' /var/log/apache2/access.log > output.txt

Show Suggested Answer

Suggested Answer: C

by Alease at Jul 13, 2024, 07:20 PM

Limited Time Offer

25%

Off

Get Premium CFR-210 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Peggie

13 days ago

Haha, this question is a classic. It's like they're trying to trick us with all these similar-looking IP address patterns. I'm going to go with option C, just to mess with them. You know, keep them on their toes.

upvoted 0 times

...

Hillary

16 days ago

Hold up, what's with all these IP address ranges? I thought we were supposed to be good at this cybersecurity stuff, not network engineering. I'm going to go with option B and hope for the best.

upvoted 0 times

...

1 months ago

Option C seems like the way to go. The `--v` flag in the grep command will allow us to exclude the internal Class A addresses, which is exactly what the incident responder needs.

upvoted 0 times

Alita

12 days ago

That's right, option C will help parse out the common internal Class A addresses effectively.

upvoted 0 times

...

Freeman

15 days ago

Using the --v flag will exclude the internal Class A addresses from the log.

upvoted 0 times

...

Isaac

24 days ago

I agree, option C with the --v flag looks like the best choice.

upvoted 0 times

...