Network Forensics Fundamentals DFE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which activity is an example of analyzing network traffic to detect malicious activity?

   • AReviewing firewall logs for repeated connection attempts to a single port
   • BExamining the Windows registry for startup entries
   • CChecking the file system for recently modified files
   • DReviewing the BIOS version of a server
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst needs to review historical network traffic to identify patterns of communication with a known malicious domain. The analyst has access to the organization's DNS logs and netflow data. Which tool would be most appropriate for correlating these logs to find the internal hosts that communicated with the domain?

   • AWireshark, to analyze the packet captures from the DNS server.
   • BA packet capture tool like tcpdump, to capture new traffic to the domain.
   • CNmap, to scan the internal network for hosts that might be infected.
   • DA SIEM platform that can ingest and correlate DNS logs and netflow data.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a significant challenge in network forensics?

   • ALack of available forensic tools
   • BInability to capture packets on modern networks
   • CEncrypted network traffic
   • DNetwork forensics is not admissible in court
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   During an incident response, a network administrator discovers that an attacker has been using SSH to move laterally between Linux servers. The administrator wants to preserve evidence for a forensic investigation. Which action best aligns with the preservation step of the network forensic process?

   • ARun a packet capture on the affected servers to collect future SSH traffic, then analyze it later.
   • BCopy the SSH logs to a USB drive and then delete the original logs to prevent the attacker from tampering with them.
   • CCreate a forensic image of the affected servers' memory and disk, and record cryptographic hashes of the images.
   • DImmediately disconnect the servers from the network to stop the attack, then continue normal operations.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A forensic analyst is investigating a distributed denial-of-service (DDoS) attack that occurred over a 48-hour period. The network team captured traffic at the perimeter, but the volume is enormous, and the analyst has limited time to identify the attack patterns. The analyst must also preserve evidence for potential legal action. What is the most effective approach?

   • ARely on the network team's memory of the attack because the capture is too large to analyze.
   • BDelete the captures after extracting summary statistics to free up storage space.
   • CUse a network forensic tool to filter and aggregate the captures, focusing on high-volume flows and anomalous patterns, while preserving the original captures with hashes.
   • DAnalyze only the first hour of the capture because the attack patterns are likely consistent throughout.
   Reveal Solution Discussion Select an answer first