Network Forensics ECSS Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst is investigating a suspected data exfiltration from a corporate web server. The analyst has access to the server's access logs and a packet capture taken from the server's network interface during the incident window. The analyst wants to determine whether the exfiltration used HTTPS or a covert tunnel over DNS. Which approach would most directly answer this question?

   • ACompare the server's access log entries with the packet capture to identify sessions that have no corresponding HTTP request.
   • BFilter the packet capture for TCP port 443 and analyze the TLS handshake certificates to identify the destination hosts.
   • CInspect the packet capture for DNS queries with unusually large response sizes or high query rates to a single domain.
   • DExamine the packet capture for both TLS handshakes on port 443 and DNS queries with anomalous payload sizes or query patterns.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of maintaining a chain of custody for network evidence?

   • ATo encrypt the evidence
   • BTo ensure the evidence is admissible in court
   • CTo speed up the investigation process
   • DTo reduce the size of the evidence
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A small company has experienced a security breach. The only network evidence available is the firewall logs and a partial packet capture from a single switch. The company does not have a SIEM or centralized logging. The investigator needs to reconstruct the attack path. What is the most significant limitation of this evidence?

   • AThe firewall logs are not admissible in court because they are not packet captures.
   • BThe packet capture may be incomplete, and the firewall logs may not contain full packet contents.
   • CThe evidence is insufficient because it does not include NetFlow data.
   • DThe packet capture cannot be used because it was not taken from the server's interface.
   Reveal Solution Discussion Select an answer first
5. 24expert · medium

   An investigator has captured a PCAP file that is 50 GB in size. The investigator needs to preserve the evidence for a court case that may take months to resolve. The storage budget is limited. Which approach best balances the need for integrity and cost?

   • AStore the PCAP file on a low-cost cloud storage bucket with versioning enabled
   • BCompress the PCAP file and store it on a write-once optical disc
   • CDelete the PCAP file after extracting the relevant packets to save space
   • DCalculate a SHA-256 hash of the PCAP file, store the hash securely, and store the PCAP on a network-attached storage (NAS) with restricted access
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a forensically sound practice when preserving network evidence?

   • ADeleting duplicate files to save space
   • BStoring the evidence on the same server it came from
   • CMaking a bit-for-bit copy of the original data
   • DOpening the evidence files to verify their contents
   Reveal Solution Discussion Select an answer first