Network Forensics Fundamentals DFE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A network administrator is investigating a possible malware infection that is using DNS tunneling to exfiltrate data. Which evidence source would be most useful in detecting this activity?

   • AThe host's event log, which may show malware execution.
   • BDNS server logs, which record all DNS queries and responses.
   • CThe host's web browser history, which may show the tunneling domain.
   • DThe firewall's rule set, which shows which ports are allowed.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An organization uses a network intrusion detection system (IDS) that generates alerts based on signature matching. The IDS has been missing some attacks because the attackers are using encryption and fragmentation. Which additional technique would most improve the detection of these evasive attacks?

   • ADeploy a network forensic tool that performs deep packet inspection (DPI) and can reassemble fragmented packets before analysis.
   • BUse a host-based firewall to block all encrypted traffic from the network.
   • CRely on the IDS's built-in SSL decryption feature, which works for all encrypted traffic.
   • DIncrease the IDS signature sensitivity to catch more anomalies, even if it increases false positives.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which step in the network forensic process involves ensuring that captured evidence is protected from alteration or destruction?

   • APreservation
   • BCollection
   • CAnalysis
   • DIdentification
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A network administrator is responding to a suspected malware infection that is beaconing to an external IP. The administrator wants to collect evidence that will help identify the malware's command-and-control (C2) traffic. Which evidence source would be most useful for this purpose?

   • AA packet capture of the infected host's outbound traffic, taken during the beaconing period.
   • BThe host's event log, which may contain malware execution events.
   • CThe host's web browser history, which may show the C2 URL if the malware used a browser.
   • DThe firewall's connection log, which shows the source and destination IPs and ports.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A small company suspects that an employee is using the corporate network to upload proprietary source code to a personal cloud storage service. The IT manager wants to determine whether the upload actually occurred and, if so, what data was sent. Which combination of network forensic activities would best achieve this?

   • ARun an antivirus scan on the employee's computer to look for malware that might have caused the upload.
   • BReview only the firewall logs to see if any connections were made to the cloud storage service's IP address.
   • CInterview the employee and ask them to explain their network usage, then decide based on their response.
   • DCollect proxy logs and firewall logs, then perform a packet capture on the employee's switch port during a controlled test to observe the upload behavior.
   Reveal Solution Discussion Select an answer first