What type of data does NetFlow provide that is useful for detecting data exfiltration?

Metadata about flows, including source/destination IPs, ports, and byte counts

The encryption keys used for secure communications

The full content of each packet

The physical location of the source device

What is the purpose of configuring port mirroring on a switch for network forensic capture?

To increase the bandwidth of the monitored port

To block malicious traffic from reaching its destination

To copy traffic from one or more ports to a monitoring port for analysis

To encrypt traffic between switches

A forensic investigator has captured network traffic using tcpdump on a compromised server. The investigator needs to preserve the evidence for legal proceedings. Which action is most important to maintain the chain of custody and integrity of the captured data?

Copy the pcap file to a USB drive and keep it in the investigator's desk drawer.

Email the pcap file to the legal team for safekeeping.

Convert the pcap file to CSV format for easier analysis and discard the original.

Calculate a SHA-256 hash of the pcap file and document the hash value in the case notes.

An investigator is correlating firewall logs, IDS alerts, and web server logs to reconstruct an attack timeline. The firewall logs show an allowed inbound connection from an external IP to the web server at 14:32:05, the IDS alert for a SQL injection attempt is timestamped 14:32:11, and the web server log shows a suspicious request at 14:32:09. The investigator notices that the firewall and IDS timestamps are in UTC, while the web server logs are in local time (UTC+2). What is the correct first step to ensure an accurate timeline?

Convert all timestamps to UTC and then sort the events.

Use the IDS timestamp as the authoritative time because it is the most precise.

Adjust the firewall logs to local time to match the web server logs.

Ignore the web server logs because they are in a different timezone.

EC-CouncilComputer Hacking Forensic Investigator

Domain 4Objective 1

Network Forensics CHFI Practice Questions (Page 3)

Part of the Network and Malware Forensics domain, which makes up ~15% of our current practice bank.

57questions here

12free pages

11concepts

Questions 11–15

11foundation · easy
What type of data does NetFlow provide that is useful for detecting data exfiltration?
Select an answer first
12foundation · easy
What is the purpose of configuring port mirroring on a switch for network forensic capture?
Select an answer first
13foundation · easy
Which network forensic tool provides a graphical interface for deep packet inspection and protocol analysis?
Select an answer first
14application · medium
A forensic investigator has captured network traffic using tcpdump on a compromised server. The investigator needs to preserve the evidence for legal proceedings. Which action is most important to maintain the chain of custody and integrity of the captured data?
Select an answer first
15application · medium
An investigator is correlating firewall logs, IDS alerts, and web server logs to reconstruct an attack timeline. The firewall logs show an allowed inbound connection from an external IP to the web server at 14:32:05, the IDS alert for a SQL injection attempt is timestamped 14:32:11, and the web server log shows a suspicious request at 14:32:09. The investigator notices that the firewall and IDS timestamps are in UTC, while the web server logs are in local time (UTC+2). What is the correct first step to ensure an accurate timeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

Network Forensics CHFI Practice Questions (Page 3)

Questions 11–15

What type of data does NetFlow provide that is useful for detecting data exfiltration?

What is the purpose of configuring port mirroring on a switch for network forensic capture?

Which network forensic tool provides a graphical interface for deep packet inspection and protocol analysis?

A forensic investigator has captured network traffic using tcpdump on a compromised server. The investigator needs to preserve the evidence for legal proceedings. Which action is most important to maintain the chain of custody and integrity of the captured data?

Keep studying — Network and Malware Forensics