A forensic investigator has captured network traffic using Wireshark on a Windows workstation. The investigator needs to preserve the evidence for a court case. The investigator has already calculated a SHA-256 hash of the pcap file. What additional step is most important to ensure the evidence is legally defensible?

Upload the pcap file to a cloud storage service.

Compress the pcap file to save space.

Print the pcap file and store the paper copy.

Store the pcap file on a write-once medium, such as a DVD-R, and document the hash.

Which packet capture characteristic is commonly used as an indicator of a TCP SYN scan?

Packets with the ACK flag set to initiate connections

A large number of ICMP echo requests

A series of packets with only the SYN flag set, followed by RST responses

Which flow analysis technique would help identify a long-running communication pattern between an internal host and a known command-and-control server?

Analyzing DNS logs for domain names

Examining flow records for repeated connections to the same external IP at regular intervals

Inspecting the payload of each packet for malicious strings

Checking the ARP cache on the internal host

EC-CouncilComputer Hacking Forensic Investigator

Domain 4Objective 1

Network Forensics CHFI Practice Questions (Page 10)

Part of the Network and Malware Forensics domain, which makes up ~15% of our current practice bank.

57questions here

12free pages

11concepts

Questions 46–50

46expert · medium
A forensic investigator has captured network traffic using Wireshark on a Windows workstation. The investigator needs to preserve the evidence for a court case. The investigator has already calculated a SHA-256 hash of the pcap file. What additional step is most important to ensure the evidence is legally defensible?
Select an answer first
47foundation · easy
Which of the following is a source of network evidence that records the metadata of communication sessions, such as source and destination IP addresses, ports, and timestamps?
Select an answer first
48foundation · easy
Which section of a network forensic report typically describes the tools and techniques used during the investigation?
Select an answer first
49foundation · easy
Which packet capture characteristic is commonly used as an indicator of a TCP SYN scan?
Select an answer first
50foundation · easy
Which flow analysis technique would help identify a long-running communication pattern between an internal host and a known command-and-control server?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

Network Forensics CHFI Practice Questions (Page 10)

Questions 46–50

Which of the following is a source of network evidence that records the metadata of communication sessions, such as source and destination IP addresses, ports, and timestamps?

Which section of a network forensic report typically describes the tools and techniques used during the investigation?

Which packet capture characteristic is commonly used as an indicator of a TCP SYN scan?

Which flow analysis technique would help identify a long-running communication pattern between an internal host and a known command-and-control server?

Keep studying — Network and Malware Forensics