CFR-410 Exam Dumps : CyberSec First Responder (CFR) Exam

The host that owns the IP address sends an ARP reply message with its physical address. Each host machine maintains a table, called ARP cache, used to convert MAC addresses to IP addresses. Since ARP is a stateless protocol, every time a host gets an ARP reply from another host, even though it has not sent an ARP request for that reply, it accepts that ARP entry and updates its ARP cache. The process of updating a target host’s ARP cache with a forged entry is referred to as poisoning.

Dealing with systems that are suspected to be used to commit a crime: Incident response involves addressing systems that may be involved in criminal activity, helping to contain and investigate the incident.

Collecting data from computer media: This is a key part of the evidence-gathering phase of incident response, where forensic data is collected to understand the extent of the incident.

Dealing with systems suspected to be the victim of a crime: Incident response includes handling systems that are compromised or victims of a crime to prevent further damage and to restore security.