Network Forensics Fundamentals DFE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A forensic team is investigating a breach that occurred over a weekend. The organization's network uses dynamic IP assignment for internal hosts, and the DHCP logs were not retained. The team has packet captures from the core switch, but the captures only show IP addresses, not hostnames. What is the most significant challenge this presents, and what is the best way to address it?

   • AThe team should use the packet captures to determine the MAC addresses and then look up the vendor to identify the device.
   • BThe lack of DHCP logs makes it difficult to map IP addresses to specific hosts; the team should correlate the packet captures with any available endpoint logs or authentication logs to identify the hosts.
   • CThe team should re-run the DHCP server to generate new logs for the incident period.
   • DThe team should assume that all IP addresses belong to the same host because the network is small.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An analyst is investigating a possible command-and-control (C2) communication. The analyst notices regular, periodic connections to an external IP address on a non-standard port. The connections are short and use a small amount of data. Which analysis technique would best help confirm this is C2 traffic?

   • AAnalyze the regularity and periodicity of the connections, and correlate with any malware signatures or threat intelligence.
   • BCheck the firewall logs to see if the connections were blocked.
   • CUse a port scanner to check if the external IP has any open ports.
   • DReview the DNS logs to see if the external IP has a domain name.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A network forensic analyst needs to capture traffic on a high-speed link without dropping packets. The analyst also needs to save the captures for later analysis. Which tool or approach is best suited for this task?

   • AUse tcpdump with a large capture buffer and write the output directly to a dedicated storage device.
   • BUse Nmap to capture traffic while scanning the network.
   • CUse Wireshark's graphical interface to capture traffic and save it to a file.
   • DUse the Windows Event Viewer to log network connections.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A forensic investigator is analyzing network traffic from a compromised host that used a VPN to communicate with a C2 server. The VPN traffic is encrypted, and the investigator does not have the VPN keys. Which approach would be most effective in identifying the C2 server's IP address?

   • AUse a brute-force attack to decrypt the VPN traffic, which is feasible for modern encryption.
   • BAnalyze the packet capture for the VPN handshake to extract the server's certificate, which contains the IP address.
   • CAnalyze the VPN tunnel's metadata, such as the destination IP and connection times, from the VPN server logs.
   • DLook at the host's local firewall logs to see the VPN connection's destination IP.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A forensic analyst is investigating a data breach that involved a web application. The analyst has access to the web server logs, the application logs, and a packet capture of the attack traffic. Which approach would best reconstruct the attack timeline?

   • ACorrelate the timestamps from the web server logs, application logs, and packet capture to build a chronological sequence of events.
   • BAnalyze only the packet capture to identify the attacker's IP address and then search for that IP in the logs.
   • CReview only the web server logs to see which pages were accessed during the attack.
   • DUse the application logs to determine what data was accessed, and ignore the other sources.
   Reveal Solution Discussion Select an answer first