Network Forensics CHFI Practice Questions (Page 9)

Questions 41–45

1. 41expert · medium

   An investigator is reconstructing a network attack. The investigator has the following evidence: a firewall log showing an inbound connection from IP 203.0.113.5 to a web server at 09:00:00, an IDS alert for a buffer overflow attempt at 09:00:02, and a NetFlow record showing an outbound connection from the web server to IP 198.51.100.7 at 09:05:00. The investigator also has a pcap file that shows the inbound connection and the outbound connection. Which conclusion is best supported by this evidence?

   • AThe web server was used to launch a DDoS attack against 198.51.100.7.
   • BThe evidence is insufficient to draw any conclusions.
   • CThe attacker exploited the web server and used it to connect to a command-and-control server.
   • DThe attacker only scanned the web server and the outbound connection is unrelated.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which command-line tool is commonly used to capture network packets and save them to a PCAP file?

   • Atraceroute
   • Bping
   • Ctcpdump
   • Dnmap
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   When correlating logs from multiple network devices, what is the primary purpose of normalizing timestamps?

   • ATo encrypt the logs for secure storage
   • BTo delete duplicate log entries
   • CTo compare events across devices on a common time scale
   • DTo reduce the size of log files
   Reveal Solution Discussion Select an answer first
5. 44expert · medium

   A forensic investigator needs to capture traffic on a busy network segment for a legal case. The segment carries 1 Gbps of traffic, and the investigator has a laptop with a 1 Gbps NIC and a 500 GB hard drive. The capture must run for 24 hours and preserve full packets. The investigator is concerned about disk space and packet loss. Which approach is the most practical?

   • ACapture only packet headers to reduce disk usage.
   • BUse a dedicated capture appliance with RAID storage and a tap.
   • CCapture full packets to the laptop's hard drive using tcpdump with a large ring buffer.
   • DUse NetFlow instead of packet capture to save disk space.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A forensic investigator needs to capture traffic on a critical production switch segment without introducing any inline failure point or altering the timing of the traffic. The switch supports SPAN and the organization has a dedicated forensic analysis VLAN. Which approach should the investigator use?

   • AEnable NetFlow export on the switch and collect flow records on the analysis server.
   • BInsert an inline network tap between the switch and the router, then connect the tap's monitor port to the analysis VLAN.
   • CConfigure a SPAN session on the switch to send a copy of the traffic to the forensic analysis port.
   • DInstall tcpdump on the router and capture traffic directly on its external interface.
   Reveal Solution Discussion Select an answer first