Network Forensics ECSS Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security analyst is reviewing NetFlow records to identify a possible distributed denial-of-service (DDoS) attack. The analyst notices a large number of flows from many different source IPs to a single destination IP on port 80. Each flow has a low packet count and short duration. Which pattern in the flow data best supports the DDoS hypothesis?

   • AA single source IP sending a large volume of data to the destination over a long duration.
   • BA high number of unique source IPs with similar packet sizes and synchronized timing.
   • CMultiple flows from the same source to different destination ports on the same host.
   • DA few flows with very large packet counts and long durations between two internal hosts.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary function of an Intrusion Detection System (IDS)?

   • ATo replace the need for firewall logs
   • BTo block malicious traffic automatically
   • CTo monitor network traffic and generate alerts on suspicious activity
   • DTo encrypt network communications
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   During an incident response, a forensic investigator is correlating events from a firewall, a proxy server, and an IDS. The firewall logs show outbound connections to a suspicious IP, the proxy logs show HTTP requests to a malicious domain, and the IDS alerts show a signature match for a known exploit. The timestamps on the three devices differ by up to 30 seconds. What is the most important first step to ensure accurate correlation?

   • ASort the logs by the order they were received by the SIEM, ignoring device timestamps
   • BConvert all timestamps to the local timezone of the firewall
   • CVerify that all devices are synchronized to the same NTP server and document any offsets
   • DUse the IDS alert timestamps as the authoritative timeline and adjust the other logs to match
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A forensic investigator has collected packet captures, firewall logs, and NetFlow records as evidence in a network intrusion case. The investigator must ensure the evidence is admissible in court. Which action is most critical to maintain the chain of custody?

   • ADocument who collected the evidence, when, and where, and store it in a secure location with controlled access.
   • BMake multiple copies of the evidence and distribute them to all investigation team members.
   • CEncrypt the evidence files and store the encryption key with the investigator.
   • DUse a write-blocker when copying the evidence from the network devices.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A forensic investigator has collected network evidence from multiple sources, including packet captures, firewall logs, and IDS alerts. The investigator needs to present the evidence in court. The defense attorney challenges the authenticity of the evidence, claiming it could have been altered. Which practice would best support the authenticity of the evidence?

   • ACalculate cryptographic hashes of all evidence files at the time of collection and document the hashes in the chain of custody.
   • BKeep the evidence on the original capture device without making any copies.
   • CRely on the IDS vendor's certification that the alerts are authentic.
   • DUse a write-blocker when copying the evidence from network devices.
   Reveal Solution Discussion Select an answer first