A network administrator discovers that an internal server exfiltrated data to an external IP address at 3:00 AM. The administrator has packet captures from that time. Which analysis step would BEST confirm the data exfiltration and identify the method?

Run a vulnerability scan against the external IP.

Count the number of packets in the capture.

Reconstruct the TCP streams and inspect the payload contents.

Check the source MAC address of the packets.

EC-CouncilCertified Cybersecurity Technician

Domain 7Objective 2

Computer Forensics CCT Practice Questions (Page 12)

Part of the Incident Response and Computer Forensics domain, which makes up ~10% of our current practice bank.

56questions here

12free pages

13concepts

Questions 56–56

56application · medium
A network administrator discovers that an internal server exfiltrated data to an external IP address at 3:00 AM. The administrator has packet captures from that time. Which analysis step would BEST confirm the data exfiltration and identify the method?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCT” is a trademark of its owner, used for identification only.

Computer Forensics CCT Practice Questions (Page 12)

Questions 56–56

A network administrator discovers that an internal server exfiltrated data to an external IP address at 3:00 AM. The administrator has packet captures from that time. Which analysis step would BEST confirm the data exfiltration and identify the method?

Keep studying — Incident Response and Computer Forensics