Network Forensics Fundamentals DFE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   During a network forensic investigation, the analyst discovers that the attacker used a legitimate remote administration tool over an encrypted channel. The analyst has packet captures but cannot decrypt the traffic. The analyst also has endpoint logs from the compromised host. What is the best way to reconstruct the attacker's actions?

   • ACorrelate the endpoint logs with the packet captures to identify the timing and commands executed, even though the content is encrypted.
   • BIgnore the encrypted traffic and focus only on the packet metadata to determine the attacker's intent.
   • CAttempt to decrypt the traffic by guessing the encryption keys used by the remote administration tool.
   • DAsk the remote administration tool vendor to provide the decryption keys, which they are obligated to do.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A network administrator needs to determine whether a specific user accessed a restricted website during work hours. Which combination of evidence sources would provide the most reliable proof?

   • AThe firewall's connection log, which shows the destination IP and port.
   • BThe user's browser history, which shows the websites visited.
   • CThe user's computer's DNS cache, which shows recently resolved domains.
   • DProxy server logs showing the user's IP address and the website URL, along with authentication logs linking the IP to the user.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A security analyst needs to analyze a large packet capture file (10 GB) to identify all HTTP requests that contain a specific string in the URI. Which tool is best suited for this task?

   • Atcpdump, using the -A flag to print packet contents and grep for the string.
   • BNmap, using the --script http-uri-search option.
   • Ctshark, using a display filter like 'http.request.uri contains "string"'.
   • DWireshark, using its display filter to search for the string in the HTTP URI field.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A forensic investigator is called to investigate a network breach that occurred two weeks ago. The organization does not have a centralized logging system, and the investigator must rely on available evidence. Which of the following is the most significant challenge the investigator will face?

   • AThe investigator will need to use a packet capture tool to collect new traffic from the network.
   • BThe lack of centralized logs may result in incomplete evidence, as logs from different devices may not be correlated.
   • CThe investigator will need to interview all employees to determine who had access to the network.
   • DThe investigator will need to perform a vulnerability scan to identify how the breach occurred.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A forensic investigator is examining a network where the attacker used a dynamic IP address from a public DHCP pool and connected through a VPN service that does not keep logs. The investigator has packet captures from the victim's network. What is the most significant challenge this presents, and what is the best way to proceed?

   • AThe investigator should abandon the investigation because the attacker cannot be identified.
   • BThe investigator should request the VPN provider to decrypt the traffic, which is legally required.
   • CThe investigator should use the packet captures to trace the attacker's physical location via IP geolocation.
   • DThe dynamic IP and VPN make attribution difficult; the investigator should focus on correlating the packet captures with any available VPN provider logs or other evidence to identify the attacker.
   Reveal Solution Discussion Select an answer first