A company has just experienced a network breach. The CEO wants to understand how the attacker entered the network and what data was accessed. Which network forensic activity would be the first step in this investigation?

Immediately disconnect all servers from the network to prevent further damage.

Identify the scope of the incident by collecting network logs, packet captures, and device configurations.

Rebuild the affected servers from backups to restore normal operations.

Interview all employees to determine who might have caused the breach.

A security analyst needs to review logs from multiple sources (firewall, IDS, and web server) to correlate events during an incident. Which tool would be most helpful for this task?

Wireshark, which can capture and analyze network packets.

A password cracker, which can recover passwords from captured hashes.

A SIEM (Security Information and Event Management) system, which aggregates and correlates logs from multiple sources.

Nmap, which can scan network hosts.

What is the primary purpose of network forensics?

To recover deleted files from hard drives and other storage media

To prevent all unauthorized access to a network by configuring firewalls

To identify and patch software vulnerabilities in network devices

To capture and analyze network traffic to investigate and understand network-based attacks

Which of the following is a common source of network evidence?

System event logs from a web server

Packet captures of network traffic

Registry hives from a Windows machine

A network administrator is setting up a forensic monitoring solution for a small office. The administrator wants to ensure that if a security incident occurs, there will be enough evidence to determine what happened. Which evidence source should the administrator prioritize?

Enable logging on the firewall and router to record connection attempts and traffic flows.

Rely on the ISP's logs, which are always available for forensic analysis.

Use only the built-in Windows event logs on the servers.

Install a packet capture tool on every workstation to record all traffic.

EC-CouncilDigital Forensics Essentials

Domain 5Objective 1

Network Forensics Fundamentals DFE Practice Questions (Page 7)

Part of the Network and Web Attack Forensics domain, which makes up ~15% of our current practice bank.

51questions here

11free pages

6concepts

Questions 31–35

31application · medium
A company has just experienced a network breach. The CEO wants to understand how the attacker entered the network and what data was accessed. Which network forensic activity would be the first step in this investigation?
Select an answer first
32application · medium
A security analyst needs to review logs from multiple sources (firewall, IDS, and web server) to correlate events during an incident. Which tool would be most helpful for this task?
Select an answer first
33foundation · easy
What is the primary purpose of network forensics?
Select an answer first
34foundation · easy
Which of the following is a common source of network evidence?
Select an answer first
35application · medium
A network administrator is setting up a forensic monitoring solution for a small office. The administrator wants to ensure that if a security incident occurs, there will be enough evidence to determine what happened. Which evidence source should the administrator prioritize?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.