Network Forensics ECSS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A network analyst is reviewing a packet capture and notices a series of TCP SYN packets sent to consecutive ports on the same host, each with a different source port. The destination host responds with RST packets for most ports, but one port responds with SYN-ACK. What does this pattern most likely indicate?

   • AA normal application is attempting to establish multiple connections to different services.
   • BA denial-of-service attack is flooding the host with SYN packets.
   • CA port scan is in progress, and the SYN-ACK response indicates an open port.
   • DA man-in-the-middle attack is intercepting the TCP handshake.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which network evidence source provides the most detailed information, including the actual content of communications?

   • APacket captures
   • BFirewall logs
   • CNetFlow records
   • DProxy logs
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   After completing a network forensic investigation, an analyst must write a report for non-technical management. Which approach is most appropriate for the report?

   • AUse technical jargon to demonstrate the thoroughness of the investigation
   • BInclude raw packet captures and detailed technical logs in the main body
   • CFocus only on the attacker's IP addresses and leave out the business impact
   • DProvide a high-level summary of findings, impact, and recommended actions
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is a common source of network evidence that records metadata about network communications, such as source and destination IP addresses, ports, and timestamps?

   • AFull packet captures
   • BConfiguration files
   • CNetFlow records
   • DSystem event logs
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A forensic analyst is building a timeline of events from firewall logs, proxy logs, and IDS alerts. The analyst notices that the firewall logs are in UTC, the proxy logs are in local time (UTC+5), and the IDS alerts include a time zone offset. To create an accurate timeline, what should the analyst do?

   • AConvert all timestamps to a single standard time zone, such as UTC, and note the original time zone in the report.
   • BUse the local time zone for all events because it is the most relevant to the organization.
   • CKeep the timestamps as they are and manually adjust the timeline based on the known time zone differences.
   • DIgnore the time zone differences and rely on the sequence of events as recorded.
   Reveal Solution Discussion Select an answer first