Network Forensics CHFI Practice Questions (Page 2)

Questions 6–10

1. 6expert · medium

   A company has suffered a data breach. The incident response team has collected firewall logs, IDS alerts, and NetFlow data. The team is now in the forensic analysis phase. Which activity is most aligned with the goals of network forensics?

   • AIdentifying the attacker's identity by tracing the source IP address.
   • BPatching the vulnerabilities that were exploited.
   • CDetermining the scope of the breach by correlating logs and flows to identify affected systems.
   • DDeleting the logs to prevent further exposure.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An investigator is analyzing a pcap file and sees a series of ICMP Echo Request packets with payloads containing random data sent to multiple hosts. The investigator suspects covert communication. Which analysis technique would best confirm this?

   • AVerify that the ICMP packets are responses to previous requests.
   • BExamine the ICMP payloads for patterns or hidden data.
   • CCount the number of ICMP packets per second.
   • DCheck the TTL values in the ICMP packets.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After completing a network forensic investigation, an investigator must write a report for legal counsel. Which element is MOST important to include?

   • AThe investigator's personal opinion about the attacker's identity.
   • BA clear methodology section describing how evidence was collected, preserved, and analyzed.
   • CA summary of the company's security policies.
   • DA list of all tools used without explaining their purpose.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An organization has firewall logs, IDS alerts, and web server logs, but the timestamps are not synchronized. The investigator needs to build a legally defensible timeline. Which approach is the MOST reliable?

   • AUse the NTP server's logs to determine each device's offset and adjust the timestamps accordingly.
   • BUse the firewall logs as the baseline because they are the most reliable.
   • CConvert all timestamps to the investigator's local time zone.
   • DDiscard logs that have inconsistent timestamps.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is a key requirement for a forensic report to be legally defensible?

   • AIt must be signed by the CEO of the organization
   • BIt must be written in technical jargon to show expertise
   • CIt must include only the final conclusion without details
   • DIt must clearly document the methods used and the findings, with supporting evidence
   Reveal Solution Discussion Select an answer first