In the context of incident response, what is the primary goal of network forensics?

To monitor network performance and ensure high availability

To recover deleted files from hard drives and other storage media

To identify, preserve, and analyze network traffic and logs to determine what happened during a security incident

To block malicious traffic in real time and prevent further attacks

Which log source would provide the most direct evidence of a successful remote login to a server?

Authentication logs on the server

Which protocol is commonly used to synchronize clocks across network devices for forensic purposes?

SNMP (Simple Network Management Protocol)

HTTP (Hypertext Transfer Protocol)

An investigator is reconstructing an attack that involved a phishing email, a drive-by download, and data exfiltration. The investigator has email logs, proxy logs, NetFlow data, and a pcap of the exfiltration. Which combination of evidence would BEST establish the full attack timeline?

Use only the pcap of the exfiltration because it contains the most detailed data.

Rely on the proxy logs because they show the drive-by download.

Correlate email logs, proxy logs, NetFlow data, and pcap timestamps to sequence the events.

Use NetFlow data exclusively because it covers all communication.

An investigator is analyzing a pcap and sees a TCP stream with a SYN packet, then a RST packet, then another SYN to the same port. The investigator suspects a port scan. Which analysis technique would BEST confirm this?

Use the Statistics > Endpoints feature to count packets per IP.

Check if the destination IP is a known malicious address.

Look for a single SYN packet to a high port.

Examine the sequence of SYN and RST packets across multiple source IPs to identify a scanning pattern.

EC-CouncilComputer Hacking Forensic Investigator

Domain 4Objective 1

Network Forensics CHFI Practice Questions (Page 1)

Part of the Network and Malware Forensics domain, which makes up ~15% of our current practice bank.

57questions here

12free pages

11concepts

Questions 1–5

1foundation · easy
In the context of incident response, what is the primary goal of network forensics?
Select an answer first
2foundation · easy
Which log source would provide the most direct evidence of a successful remote login to a server?
Select an answer first
3foundation · easy
Which protocol is commonly used to synchronize clocks across network devices for forensic purposes?
Select an answer first
4expert · hard
An investigator is reconstructing an attack that involved a phishing email, a drive-by download, and data exfiltration. The investigator has email logs, proxy logs, NetFlow data, and a pcap of the exfiltration. Which combination of evidence would BEST establish the full attack timeline?
Select an answer first
5expert · hard
An investigator is analyzing a pcap and sees a TCP stream with a SYN packet, then a RST packet, then another SYN to the same port. The investigator suspects a port scan. Which analysis technique would BEST confirm this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.