Network Forensics Fundamentals DFE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which network device configuration would be most useful as evidence in a network forensic investigation?

   • ABIOS settings of a workstation
   • BLocal user account passwords
   • CRouter access control lists (ACLs)
   • DInstalled software list on a server
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is investigating a possible brute-force attack on the company's SSH server. The analyst has access to the server's authentication logs. Which tool would be most useful for analyzing the logs to identify the attacking IP addresses?

   • ANmap, to scan the SSH server for open ports.
   • BA log analysis tool like 'grep' or 'awk' to extract and count failed login attempts by IP address.
   • CWireshark, to capture new SSH traffic and analyze it.
   • DA password cracking tool like John the Ripper, to crack the passwords used in the attack.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A forensic investigator is called to respond to a suspected network intrusion. The organization's network team has already captured several hours of traffic and saved it to a shared drive. The investigator needs to ensure the evidence is admissible in court. What should the investigator do first?

   • ACreate a cryptographic hash of the captured files and document the chain of custody.
   • BBegin analyzing the traffic immediately to identify the attacker's methods.
   • CAsk the network team to recapture the traffic because the original capture may be incomplete.
   • DDelete any irrelevant traffic to reduce the data volume for analysis.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst is examining a packet capture and sees a large number of DNS queries for random subdomains under a single domain. The analyst suspects DNS tunneling. Which analysis technique would best confirm this?

   • AReview the web server logs to see if the domain is hosting a website.
   • BRun a port scan on the DNS server to see if it is vulnerable.
   • CCheck the DNS server's cache to see if the domain is legitimate.
   • DExamine the DNS query lengths and frequency, and correlate with the response sizes to detect anomalous patterns.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is investigating a suspected data exfiltration from a corporate network. The analyst has access to the organization's NetFlow records, DNS query logs, and a packet capture taken from the network perimeter during the suspected timeframe. Which approach would most effectively identify the destination of the exfiltrated data?

   • AUse the NetFlow records to identify the top five internal IPs by total bytes sent, then block those IPs at the firewall to stop the exfiltration.
   • BAnalyze only the packet capture for any TCP connections that lasted longer than 30 seconds, assuming that long-lived connections indicate data transfer.
   • CReview the DNS query logs alone to find any domain names that were resolved more than 100 times, assuming that high query counts indicate data exfiltration.
   • DCorrelate the NetFlow records with DNS logs to identify internal hosts that communicated with external IPs on unusual ports, then inspect the corresponding packet capture for payload content.
   Reveal Solution Discussion Select an answer first