A security analyst suspects a compromised workstation is sending large amounts of data to an external IP on port 443. The analyst has access to NetFlow data but not full packet captures. Which NetFlow field would be MOST useful to confirm the volume of data transferred?

Source and destination IP addresses

Octet count (bytes transferred)

A forensic analyst has a pcap file containing a suspicious DNS tunnel. The analyst needs to extract the full DNS queries and responses to reconstruct the tunneled data. Which tool is BEST suited for this task?

Wireshark with DNS filter and Follow UDP Stream

A forensic investigator is correlating logs from a firewall, an IDS, and a web server to build an attack timeline. The investigator notices that timestamps differ by several seconds across devices. What should the investigator do FIRST to ensure accurate correlation?

Convert all timestamps to UTC manually using the investigator's local time.

Use the IDS timestamps as the authoritative source for all events.

Ignore the time differences because they are only a few seconds.

Verify that all devices are synchronized to the same NTP time source and document any offset.

What is the purpose of maintaining a chain of custody for network evidence?

To document who handled the evidence and ensure it has not been tampered with

To compress the evidence files to save storage space

To analyze the evidence more quickly

To encrypt the evidence for secure transmission

EC-CouncilComputer Hacking Forensic Investigator

Domain 4Objective 1

Network Forensics CHFI Practice Questions (Page 11)

Part of the Network and Malware Forensics domain, which makes up ~15% of our current practice bank.

57questions here

12free pages

11concepts

Questions 51–55

51application · medium
A security analyst suspects a compromised workstation is sending large amounts of data to an external IP on port 443. The analyst has access to NetFlow data but not full packet captures. Which NetFlow field would be MOST useful to confirm the volume of data transferred?
Select an answer first
52application · medium
A forensic analyst has a pcap file containing a suspicious DNS tunnel. The analyst needs to extract the full DNS queries and responses to reconstruct the tunneled data. Which tool is BEST suited for this task?
Select an answer first
53application · medium
A forensic investigator is correlating logs from a firewall, an IDS, and a web server to build an attack timeline. The investigator notices that timestamps differ by several seconds across devices. What should the investigator do FIRST to ensure accurate correlation?
Select an answer first
54foundation · easy
What is the purpose of maintaining a chain of custody for network evidence?
Select an answer first
55application · medium
An investigator is analyzing a pcap file and needs to extract the full contents of an HTTP session, including the request and response bodies, to document a web attack. Which Wireshark feature is most appropriate for this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.