Network Forensics Fundamentals DFE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A network analyst is reviewing a packet capture and notices a series of TCP SYN packets sent to a single host on many different ports, with no corresponding SYN-ACK replies. The analyst suspects a port scan. Which tool or technique would best confirm this suspicion?

   • ACheck the ARP cache on the analyst's workstation to see if the target host responded.
   • BReview the DNS logs to see if the target host name was resolved during the scan.
   • CUse Wireshark's statistics and filtering to identify the pattern of SYN packets and the absence of replies.
   • DRun a vulnerability scan against the target host to see if any ports are open.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary goal of network traffic analysis in a forensic investigation?

   • ATo configure firewalls to block future attacks
   • BTo optimize network performance and reduce latency
   • CTo encrypt all network traffic to protect data in transit
   • DTo detect malicious activities and reconstruct the sequence of events
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A forensic investigator is examining a network that uses dynamic IP address assignment (DHCP) and has a high turnover of devices. The investigator needs to reconstruct the activities of a specific user during a particular time window. Which evidence source would be most helpful in linking the user to the network activity?

   • AThe firewall's current rule set to see which ports are open.
   • BThe user's personal calendar to see where they were during the time window.
   • CThe organization's physical access logs to see which doors the user swiped through.
   • DDHCP server logs that show IP address assignments with timestamps and MAC addresses.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A forensic investigator is called to a scene where a network breach has just been detected. The network team is already rebooting the affected servers to stop the attack. The investigator needs to preserve evidence. What is the most important action for the investigator to take?

   • AWait for the reboot to finish and then collect the logs from the servers.
   • BImmediately capture the volatile network state, such as active connections and ARP tables, before the reboot completes.
   • CAsk the network team to stop the reboot and keep the servers running.
   • DBegin the analysis of the packet captures that were already collected.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company has just experienced a network breach. The CEO asks the IT team to 'find out what happened on the network.' The IT team has access to firewall logs, intrusion detection system (IDS) alerts, and packet captures from the breach period. What is the primary role of network forensics in this situation?

   • ATo restore the network to its normal state as quickly as possible.
   • BTo systematically collect and analyze network evidence to reconstruct the sequence of events and identify the attack vector.
   • CTo identify the attacker's physical location using IP address geolocation.
   • DTo immediately block all suspicious IP addresses to prevent further damage.
   Reveal Solution Discussion Select an answer first