Network Forensics CHFI Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which combination of evidence sources is most effective for reconstructing a network-based attack?

   • AOnly firewall logs
   • BOnly packet captures
   • CPacket captures, firewall logs, and NetFlow records
   • DOnly NetFlow records
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A forensic team must capture traffic on a 10 Gbps backbone link during a critical incident. The team has a forensic server with a 1 Gbps NIC and a switch that supports SPAN. The capture must not drop packets. Which approach is the BEST?

   • ACapture traffic directly on the router's console port.
   • BUse a network tap with a built-in aggregator and a 10 Gbps capture interface on the forensic server.
   • CConfigure SPAN to send traffic to the 1 Gbps NIC and rely on the switch's buffer.
   • DUse NetFlow instead of full packet capture to reduce the data volume.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which statement best describes the role of network forensics in a legal investigation?

   • AIt focuses solely on recovering financial losses from cybercrime
   • BIt replaces the need for legal warrants when investigating network traffic
   • CIt guarantees the conviction of cybercriminals by providing irrefutable proof
   • DIt provides evidence that can be used to prove or disprove network-related activities in a court of law
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A forensic investigator has captured network traffic using a laptop connected to a SPAN port. The investigator needs to ensure the evidence is admissible in court. Which action is MOST critical?

   • AUse the latest version of Wireshark to analyze the capture.
   • BCompress the capture file to reduce its size.
   • CStore the capture on the laptop's internal drive for easy access.
   • DDocument the exact date, time, and method of capture, and maintain a chain-of-custody log.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   During packet analysis, an investigator sees a series of TCP packets with the PSH and ACK flags set, carrying small payloads to a single external IP at regular intervals. The investigator suspects a covert channel. Which analysis step would BEST confirm this?

   • AExamine the payload content for patterns or encoding that is not typical of the application protocol.
   • BCheck the TCP window size for anomalies.
   • CCount the number of packets per second.
   • DVerify the destination IP is not on a blocklist.
   Reveal Solution Discussion Select an answer first