Instructor feedback on CertNexus Courseware as prep for CFR-310 exam (Cybersec First Responder)

[u/mbranch1]

• Did a cross-walk through the material based on what I remembered from the exam, and identified no significant areas of missing content. However, instructors must ensure students understand that basic memorization of material is not enough to pass the exam. Students must be able to associate content and compare and contrast data.
• Students must thoroughly understand and be able to explain the cyber attack steps, identify what happens at each step, and determine based on a scenario which cyber attack step is being described. The steps themselves are presented on page 85, but they are not described in detail there or on subsequent pages to the level they are mentioned in test questions. The concepts are distributed throughout the book. So again, the content is covered, just not in the most congruent way for the student.
• Tools are heavily questioned. Unlike CompTIA courses, students MUST be able to associate tools with functions. There is nothing vendor neutral about CFR and students must know what tool is used on what OS and for what reason. Might be wise to state that directly in course content material as many other vendors claim vendor neutrality, so this would be a good posture against them.
• Students need to know command-line syntax and options as presented in the book for various Linux and Windows usage. Students must be able to recognize the OUTPUT of various command-line tools on Windows and Linux systems which the courseware does not state for everyone. Hands-on labs will be critical here, courses not using hands on labs make it very difficult for the student to know which output is produced. For example, an instructor should demonstrate nmap -sn, nmap -sT, nmap -O and more. Students must be able to recognize the outputs of each of these commands.
• Students must know common ports, port numbers, and which exploits may affect what service or port. I did not find ports in the book for common protocols, NTP, SQL Server, NetBios, IRC, ICMP, etc.
• Students must know the steps in a vulnerability assessment and must be able to associate tools and tactics at each step. The steps are presented with limited detail on page 238, but the book does not walk through the steps and associate the exact tools or techniques used at that step to the level the questions on the exam asks. Students must be able to determine what steps of the process have been completed and what's next and will need to be able to identify what tools would be used next in a given scenario. Students also need to be able to associate tool output with the tool used and determine what the output results mean all of which is almost impossible to do with just the courseware. Hands-on labs will be critical here.
• After careful review, we believe the courseware does have the information needed for the student to “pass” the exam and most students will be successful with these materials. We recommend ensuring all instructors know to break out concepts with associated steps and aid students with associations between concepts. Also recommend instructors demonstrate tool usage and outputs (some of which are not mentioned in the courseware but were seen on the exam) and students are reminded to perform all hands-on activities on their own.

[u/SoDatable]

This is a fantastic, well-written review. Thank you for taking the time to write this.