Network Forensics Fundamentals DFE Practice Questions (Page 8)

Questions 36–40

1. 36application · easy

   A network administrator is investigating a security incident where an attacker used a compromised account to access a file server. The administrator wants to determine the source IP address of the attacker. Which evidence source would provide this information?

   • AThe network diagram, which shows the layout of the network.
   • BThe file server's disk usage report, which shows how much data was accessed.
   • CThe file server's hardware inventory list, which lists installed components.
   • DThe authentication logs on the file server, which record the source IP of each login attempt.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   In which scenario would network forensics be most directly applied?

   • AReviewing file system metadata to determine when a file was last accessed
   • BAnalyzing captured packets to trace the source of a distributed denial-of-service (DDoS) attack
   • CInvestigating a malware infection by examining the memory of a compromised host
   • DRecovering deleted emails from a suspect's laptop
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company's legal team asks the IT department to provide evidence of a former employee's unauthorized access to the network after termination. The IT department has access to the VPN logs, firewall logs, and the employee's workstation logs. What is the best way to present this evidence?

   • AAsk the legal team to subpoena the ISP for the employee's home IP address.
   • BProvide the raw logs to the legal team without any analysis.
   • CUse a packet capture tool to capture new traffic from the former employee's account.
   • DCompile a report that correlates the VPN logs, firewall logs, and workstation logs to show the timeline of unauthorized access.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company suspects that an employee is using an unauthorized remote access tool to connect to the internal network from home. The security team wants to determine whether any such connections occurred and when. Which combination of evidence sources would provide the most reliable answer?

   • APacket captures from the internal network only, without any logs.
   • BThe employee's browser history, which might show the remote access tool's web interface.
   • CFirewall logs showing inbound connections and VPN gateway logs showing remote access sessions.
   • DOnly the employee's workstation event logs, which may show local login activity.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A forensic analyst is investigating a data breach that occurred over a period of several months. The organization's network traffic is encrypted, and the analyst only has access to netflow data and firewall logs, not full packet captures. The analyst needs to identify which internal hosts communicated with a known malicious IP. What is the best approach?

   • ACorrelate the netflow data with the firewall logs to identify the internal IPs that communicated with the malicious IP, and then use endpoint logs to identify the specific hosts.
   • BUse the netflow data to reconstruct the full content of the communications.
   • CRequest the ISP to provide the full packet captures for the entire period.
   • DAnalyze the firewall logs alone to determine the content of the communications.
   Reveal Solution Discussion Select an answer first