Network Forensics CHFI Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which device is a passive hardware tap that can be inserted into a network link to capture traffic without introducing a point of failure?

   • ARouter
   • BNetwork TAP
   • CLoad balancer
   • DFirewall
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   During an investigation, an analyst notices that the timestamps on firewall logs and IDS logs differ by several seconds for the same event. The analyst suspects clock drift on one of the devices. What is the best practice to prevent this issue in future investigations?

   • AManually adjust the clocks on all devices at the start of each investigation.
   • BConfigure all network devices to use NTP with a common time source.
   • CRecord the time offset in the report and adjust manually.
   • DUse the firewall's time as the standard and ignore other logs.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which practice is essential to preserve the integrity of a packet capture file as evidence?

   • AComputing a cryptographic hash of the file and documenting it
   • BStoring the file on a shared network drive
   • COpening the file in Wireshark to view its contents
   • DRenaming the file to a descriptive name
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   During analysis of a pcap file, an investigator notices a series of TCP SYN packets sent to a single host on port 445, each with a different source IP address, and none of the connections complete a three-way handshake. The investigator wants to determine whether this is a distributed port scan or a distributed denial-of-service (DDoS) attack. Which additional evidence would best support the DDoS conclusion?

   • AThe target host's CPU usage spikes and it becomes unresponsive to legitimate traffic during the same time window.
   • BThe target host responds with SYN-ACK packets but the connections never complete.
   • CThe SYN packets are sent at a rate of 10 packets per second.
   • DThe source IP addresses are all in the same /24 subnet.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A forensic investigator is collecting logs from multiple devices for a legal case. The investigator notices that some devices are using different time zones. What is the BEST practice for documenting timestamps in the forensic report?

   • ARecord timestamps exactly as they appear on each device without conversion.
   • BConvert all timestamps to UTC and note the original time zone for each device.
   • CUse the local time of the investigator's office for all timestamps.
   • DUse the time zone of the company headquarters for all devices.
   Reveal Solution Discussion Select an answer first