Network Forensics ECSS Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What type of information is typically found in NetFlow records?

   • AThe full payload of each packet
   • BThe content of emails sent over the network
   • CSource and destination IP addresses, ports, and timestamps
   • DThe usernames of logged-in users
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   An organization has an IDS that generates a high volume of alerts, many of which are false positives. The security team is overwhelmed and has started ignoring alerts. A forensic investigator is asked to improve the situation. Which approach best balances the need to detect real intrusions while reducing alert fatigue?

   • ATune the IDS signatures based on the organization's normal traffic patterns and known false positives
   • BIncrease the sensitivity of all IDS signatures to catch more potential threats
   • CDisable all IDS alerts that have a low severity rating
   • DReplace the IDS with a firewall that blocks all suspicious traffic
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Why is time synchronization important in network forensics?

   • AIt ensures that logs from different devices can be correlated accurately
   • BIt encrypts network traffic
   • CIt speeds up the network
   • DIt prevents packet loss
   Reveal Solution Discussion Select an answer first
5. 4expert · medium

   A forensic investigator needs to capture network traffic on a high-traffic production link without dropping packets. The investigator has a server with a 10 Gbps NIC and a RAID 0 array of two SSDs. Which tool and configuration would best ensure complete packet capture?

   • AUse a dedicated packet capture appliance with specialized hardware and software
   • BUse tcpdump with a large buffer and write directly to the RAID array
   • CUse Wireshark with promiscuous mode and save to a file
   • DUse NetFlow to record flow data instead of full packets
   Reveal Solution Discussion Select an answer first
6. 5expert · medium

   A forensic investigator is analyzing a PCAP file that contains an SSL/TLS handshake between a client and a server. The investigator needs to determine if the session was encrypted using a weak cipher suite. Which packet in the capture would contain the cipher suite information?

   • AThe ClientHello packet
   • BThe Certificate packet
   • CThe Finished packet
   • DThe ServerHello packet
   Reveal Solution Discussion Select an answer first