Network Forensics ECSS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An organization's IDS generated an alert for a known exploit attempt against a web server. The analyst checks the IDS logs and sees the alert, but the firewall logs show no corresponding block rule triggered. The web server logs show no evidence of the exploit succeeding. What should the analyst do next to determine if the attack was successful?

   • AReboot the web server to clear any potential memory-resident malware.
   • BCorrelate the IDS alert timestamp with the web server access logs to see if any requests from the attacking IP occurred at that time.
   • CCheck the firewall's default deny policy to confirm it blocks all inbound traffic.
   • DDisable the IDS rule to prevent false positives from consuming resources.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What protocol is commonly used to synchronize clocks across network devices?

   • ASNMP
   • BNTP
   • CFTP
   • DHTTP
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An organization has an IDS that generates a high volume of alerts for a specific signature. The security team is overwhelmed and has started ignoring the alerts. A forensic analyst is asked to investigate whether the alerts indicate a real attack or a false positive. The analyst has access to the IDS alerts, firewall logs, and packet captures from the affected segment. Which approach would most effectively reduce the false positive rate while ensuring real attacks are not missed?

   • AUse the IDS's built-in auto-response to block the source IPs of all alerts.
   • BCorrelate the IDS alerts with firewall logs and packet captures to verify whether the attack traffic actually reached the target.
   • CDisable the IDS signature that generates the most alerts to reduce noise.
   • DIncrease the IDS sensitivity to catch more potential attacks.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In network flow data analysis, what might an unusually high number of flows to a single destination port indicate?

   • AA potential port scan or denial-of-service attack
   • BA misconfigured DNS server
   • CA hardware failure in the network switch
   • DNormal business operations
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of capturing network packets during an investigation?

   • ATo reconstruct events and identify malicious activity
   • BTo block malicious traffic in real time
   • CTo improve network speed and reduce latency
   • DTo replace the need for log analysis
   Reveal Solution Discussion Select an answer first