Network Forensics Fundamentals DFE Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   What is the final step in the standard network forensic process?

   • AAnalysis
   • BReporting
   • CCollection
   • DExamination
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which tool is specifically designed for reviewing and analyzing logs in a network forensic investigation?

   • Atcpdump
   • BWireshark
   • CJohn the Ripper
   • DSplunk
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A network forensic investigator is examining a case where the attacker used a proxy chain to hide their identity. The investigator has captured traffic from the victim's network but cannot see the attacker's true IP address. Which technique would be most effective in tracing the attacker's identity?

   • ASend a subpoena to the attacker's ISP based on the proxy IP address.
   • BAnalyze the traffic patterns and timing to correlate with known proxy services, then request logs from those services.
   • CPerform a port scan on the proxy server to identify the attacker's open ports.
   • DUse a reverse DNS lookup on the proxy's IP address to find the attacker's true IP.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A security team needs to monitor network traffic in real time to detect a possible denial-of-service (DoS) attack. They have a limited budget and need a tool that can capture traffic and generate alerts based on unusual traffic patterns. Which tool would be most appropriate?

   • Atcpdump, because it can capture traffic and can be scripted to alert on patterns.
   • BSnort, because it is an intrusion detection system that can analyze traffic and generate alerts based on rules.
   • CNmap, because it can scan the network to detect open ports.
   • DWireshark, because it can capture and analyze traffic in real time.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A network analyst is reviewing a packet capture and notices a series of TCP SYN packets sent to a server, followed by SYN-ACK responses, but no final ACK from the client. This pattern repeats many times. What does this pattern most likely indicate?

   • AA normal TCP connection establishment process, where the client is slow to send the final ACK.
   • BA DNS query being sent over TCP, which uses a similar handshake.
   • CA network misconfiguration causing packets to be dropped.
   • DA TCP SYN flood attack, where the attacker sends many SYN packets without completing the handshake.
   Reveal Solution Discussion Select an answer first