Network Forensics ECSS Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which tool is commonly used to capture network packets for forensic analysis?

   • ANmap
   • BWireshark
   • CMetasploit
   • DJohn the Ripper
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When investigating an intrusion, what is the primary value of IDS/IPS alerts?

   • AThey replace the need for packet analysis
   • BThey provide the full content of the attack traffic
   • CThey highlight potential malicious activity that requires further investigation
   • DThey automatically patch vulnerabilities
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In a digital investigation, network forensics is most often used to:

   • AEstablish a baseline of normal network behavior for performance tuning
   • BDetermine the physical location of a network device
   • CReplace the need for host-based forensic analysis
   • DIdentify and reconstruct the sequence of events leading to a security breach
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A forensic investigator needs to capture live network traffic from a critical server without disrupting operations. The server has multiple network interfaces, and the investigator wants to ensure that the capture includes all traffic to and from the server, including traffic that may be encrypted. Which tool and configuration would best meet this requirement?

   • AUse tcpdump on the server to capture traffic on all interfaces and write to a remote storage location.
   • BUse the server's built-in firewall logging to record all connections and later reconstruct the packets.
   • CInstall a network tap inline between the server and the switch and capture with tcpdump on the tap device.
   • DConfigure a SPAN port on the switch to mirror all traffic to the server's interface and capture with Wireshark on a separate analysis machine.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A forensic investigator needs to capture network traffic on a high-throughput link (10 Gbps) during a suspected breach. The investigator has a laptop with a 1 Gbps network interface and limited storage. The goal is to preserve as much evidence as possible without dropping packets. Which approach is most appropriate?

   • AUse tcpdump on the laptop to capture traffic directly from the link.
   • BUse NetFlow data instead of packet capture to reduce the data volume.
   • CConfigure a SPAN port to send a copy of the traffic to the laptop, and use Wireshark to capture.
   • DUse a dedicated network tap with a capture appliance that has a 10 Gbps interface and sufficient storage.
   Reveal Solution Discussion Select an answer first