A forensic analyst has completed the analysis of network logs and packet captures for an incident. The analyst must now write a report for management, who are not technical. What is the most important element to include in the report?

A detailed list of all packet capture files and their SHA-256 hashes.

A clear executive summary that describes the incident, its impact, and recommended actions in non-technical language.

A technical appendix with the exact commands used to analyze the packets.

A full reproduction of all firewall log entries related to the incident.

An IDS generates an alert for a known exploit attempt against a web server. The alert includes the source IP, destination IP, and a timestamp. The investigator wants to confirm whether the exploit actually succeeded and whether any data was accessed. Which additional evidence source would be most useful for this confirmation?

Web server access logs showing the corresponding HTTP requests and responses

NetFlow records showing the volume of traffic between the two IPs

DNS logs showing the hostname resolution for the source IP

Firewall logs showing that the connection was allowed

A forensic investigator has captured network traffic related to an ongoing intrusion. The investigator needs to preserve the evidence for potential legal proceedings. Which action is most important to maintain the admissibility of the evidence?

Compress the PCAP file to save space

Email the PCAP file to the legal team for safekeeping

Store the PCAP file on a network share that is backed up daily

Calculate a cryptographic hash of the PCAP file and document the hash value

A security analyst is reviewing NetFlow data to identify a potential data exfiltration. The analyst notices a large number of flows from an internal server to an external IP on port 53 (DNS). The flows have small packet sizes but a high packet count, and the destination IP is not the organization's configured DNS server. What is the most likely explanation?

The server is performing a DNS zone transfer to an external server.

The server is using DNS tunneling to exfiltrate data.

The server is configured with a wrong DNS server IP address.

The server is experiencing a DNS amplification attack.

Which element is essential to include in a network forensic report?

The personal opinions of the investigator

The vendor names of all network hardware

EC-CouncilCertified Security Specialist

Domain 6Objective 3

Network Forensics ECSS Practice Questions (Page 6)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

50questions here

10free pages

11concepts

11 Concepts in This Objective

Network Forensics Fundamentals
Network Evidence Sources
Packet Capture and Analysis
Network Log Analysis
Network Flow Data Analysis
Network Intrusion Detection and Prevention
Network Attack Vectors and Patterns
Network Time Synchronization and Correlation
Network Forensic Tools
Network Evidence Preservation and Documentation
Network Forensic Reporting

Questions 26–30

26application · medium
A forensic analyst has completed the analysis of network logs and packet captures for an incident. The analyst must now write a report for management, who are not technical. What is the most important element to include in the report?
Select an answer first
27application · medium
An IDS generates an alert for a known exploit attempt against a web server. The alert includes the source IP, destination IP, and a timestamp. The investigator wants to confirm whether the exploit actually succeeded and whether any data was accessed. Which additional evidence source would be most useful for this confirmation?
Select an answer first
28application · medium
A forensic investigator has captured network traffic related to an ongoing intrusion. The investigator needs to preserve the evidence for potential legal proceedings. Which action is most important to maintain the admissibility of the evidence?
Select an answer first
29expert · hard
A security analyst is reviewing NetFlow data to identify a potential data exfiltration. The analyst notices a large number of flows from an internal server to an external IP on port 53 (DNS). The flows have small packet sizes but a high packet count, and the destination IP is not the organization's configured DNS server. What is the most likely explanation?
Select an answer first
30foundation · easy
Which element is essential to include in a network forensic report?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Network Forensics ECSS Practice Questions (Page 6)

Questions 26–30

A forensic analyst has completed the analysis of network logs and packet captures for an incident. The analyst must now write a report for management, who are not technical. What is the most important element to include in the report?

A forensic investigator has captured network traffic related to an ongoing intrusion. The investigator needs to preserve the evidence for potential legal proceedings. Which action is most important to maintain the admissibility of the evidence?

Which element is essential to include in a network forensic report?

Keep studying — Digital Forensics Investigations