exam questions

Exam CFR-310 All Questions

View all questions & answers for the CFR-310 exam

Exam CFR-310 topic 1 question 60 discussion

Actual exam question from CertNexus's CFR-310
Question #: 60
Topic #: 1
[All CFR-310 Questions]

While reviewing some audit logs, an analyst has identified consistent modifications to the sshd_config file for an organization’s server. The analyst would like to investigate and compare contents of the current file with archived versions of files that are saved weekly. Which of the following tools will be MOST effective during the investigation?

  • A. cat * | cut –d ‘,’ –f 2,5,7
  • B. more * | grep
  • C. diff
  • D. sort *
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
044f354
2 months, 4 weeks ago
Selected Answer: C
C. diff Explanation: diff is a tool that compares the contents of two files line by line and highlights the differences between them. In this case, the analyst can use diff to compare the current sshd_config file with archived versions to identify what changes have been made over time. Why the other answers are less suitable: A. cat * | cut –d ‘,’ –f 2,5,7: This command concatenates files and uses cut to extract specific fields based on a delimiter. It’s not designed for comparing files. B. more * | grep: This command allows the user to view files (more) and search for specific text (grep), but it doesn’t compare files or highlight differences between them. **D. sort ***: The sort command arranges the contents of a file in a specified order. It’s not used for comparing file contents or identifying differences.
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago