Network Forensics CHFI Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why is network time synchronization critical for forensic evidence?

   • AIt ensures that timestamps from different devices are consistent and can be correlated accurately
   • BIt encrypts the network traffic to prevent tampering
   • CIt prevents attackers from spoofing IP addresses
   • DIt increases the speed of forensic analysis
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An investigator captures network traffic during an incident and stores the pcap file on a forensic workstation. Which action is MOST important to maintain the evidence's legal admissibility?

   • ACopy the pcap file to a USB drive for backup.
   • BCreate a cryptographic hash of the pcap file and document the hash in the chain-of-custody record.
   • COpen the pcap file in Wireshark to verify its contents.
   • DCompress the pcap file to save space.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is reviewing NetFlow data to identify potential data exfiltration from a corporate network. Which flow pattern is the strongest indicator of a large-scale data exfiltration?

   • AMultiple internal hosts communicating with the same external server on port 80 during business hours.
   • BAn internal host receiving 500 MB of data from an external server on port 53.
   • CAn internal host transferring 2 GB of data to an external IP on port 443 in a single flow during off-hours.
   • DA single flow from an internal host to an external server with a duration of 2 minutes and 5 MB of data transferred.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A forensic investigator is preparing a report for a legal case involving network evidence. The report must be admissible in court. Which element is most critical to include in the report?

   • AA list of all employees who had access to the network during the incident.
   • BA detailed description of the tools and methods used, including hash values and timestamps.
   • CThe raw pcap file attached to the report.
   • DThe investigator's personal opinion about the attacker's identity.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An investigator is reconstructing a multi-stage attack. The firewall logs show an inbound connection from an external IP, the IDS logs show a SQL injection alert, and the web server logs show a successful login from the same IP. Which sequence BEST establishes the attack timeline?

   • AAssume the web server login occurred first because it is the final stage.
   • BRely on the IDS alert as the starting point because it is the most specific.
   • CUse the firewall log as the authoritative source because it is the first line of defense.
   • DCorrelate the timestamps from all three log sources to order the events chronologically.
   Reveal Solution Discussion Select an answer first