Network Forensics Fundamentals DFE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A small business has been the victim of a ransomware attack. The IT administrator wants to understand how the ransomware entered the network. The administrator has access to the firewall logs, email gateway logs, and a packet capture from the time of the attack. What is the best way to determine the entry vector?

   • AUse the packet capture to identify the ransomware's command-and-control server and block it.
   • BCorrelate the firewall logs, email gateway logs, and packet capture to trace the initial infection path.
   • CCheck the firewall logs for any blocked inbound connections.
   • DReview the email gateway logs for any spam emails that were quarantined.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which tool is commonly used for packet capture in network forensics?

   • AAutopsy
   • BMetasploit
   • CWireshark
   • DNmap
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A forensic investigator is analyzing a network capture from a compromised server that communicated with a command-and-control (C2) server over HTTPS. The investigator has the server's private key. Which approach would allow the investigator to decrypt and analyze the C2 traffic?

   • AAnalyze the encrypted traffic patterns to determine the C2 commands, as encryption does not prevent pattern analysis.
   • BUse the private key to decrypt the TLS sessions in the packet capture, provided the key matches the certificate used for those sessions.
   • CUse a brute-force attack on the TLS session keys, which is feasible for modern encryption.
   • DRequest the C2 server's private key from the attacker, as it is needed to decrypt the traffic.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   During an investigation of a network breach, the forensic team discovers that the attacker used TLS-encrypted communications to an internal server. The team has full packet captures from the perimeter, but the sessions are encrypted. The organization uses a proxy that can decrypt TLS traffic, but the proxy logs were not retained for the incident period. What is the most practical next step to obtain the plaintext of the encrypted sessions?

   • AReplay the captured TLS sessions to the internal server to observe the plaintext responses.
   • BUse a brute-force attack to recover the private key of the internal server from the captured TLS handshake.
   • CAnalyze the TLS handshake metadata to infer the content of the sessions from the cipher suite and certificate details.
   • DRequest the proxy's TLS session keys or decrypted traffic logs from the proxy vendor, if available, and correlate them with the packet captures.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Why is the high volume of network data a challenge in network forensics?

   • AIt makes it difficult to identify relevant evidence among massive amounts of traffic
   • BIt causes network devices to stop functioning
   • CIt makes all evidence inadmissible in court
   • DIt prevents the use of any forensic tools
   Reveal Solution Discussion Select an answer first