Network Forensics ECSS Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A network administrator notices that a single internal host has been communicating with a remote server on port 443 at a steady rate of 2 Mbps for the past 72 hours. The host is a standard user workstation. NetFlow records confirm the traffic is continuous and bidirectional. Which type of activity does this pattern most likely indicate?

   • AA denial-of-service attack originating from the workstation
   • BA misconfigured backup job sending data to a cloud storage service
   • CA legitimate software update download that is being throttled
   • DA data exfiltration tunnel using HTTPS to hide the content
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A network forensic analyst is examining a PCAP file and notices a series of TCP SYN packets sent to a single host on consecutive ports (1, 2, 3, ...) with no corresponding SYN-ACK replies. Which attack pattern does this represent?

   • AA TCP SYN flood denial-of-service attack
   • BA man-in-the-middle attack using ARP spoofing
   • CA DNS amplification attack
   • DA vertical port scan to identify open services
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   An investigator needs to analyze a large PCAP file to extract all HTTP requests that contain the string 'password' in the URI. Which tool is most appropriate for this task?

   • ANmap with the --script http-title option
   • Btcpdump with the -w flag to write the filtered packets to a new file
   • CNetFlow collector to view flow records
   • DWireshark with a display filter: http.request.uri contains 'password'
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security analyst is investigating a possible malware infection that communicates with a command-and-control (C2) server. The analyst has access to firewall logs, proxy logs, DNS logs, and NetFlow data. Which combination of evidence sources would provide the most complete picture of the C2 communication?

   • AFirewall logs and NetFlow data only
   • BDNS logs and NetFlow data only
   • CFirewall logs, proxy logs, DNS logs, and NetFlow data
   • DProxy logs and DNS logs only
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A forensic investigator is analyzing a packet capture from a compromised host. The capture shows a TCP connection to an external IP on port 4444. The payload appears to be encrypted, but the investigator notices that the connection was initiated shortly after the host received a phishing email. The investigator suspects a reverse shell. Which additional evidence in the packet capture would most strongly confirm the reverse shell hypothesis?

   • AThe connection uses a non-standard port, which is often used by malware.
   • BThe external IP has a history of port scanning in the organization's firewall logs.
   • CThe packet capture shows a bidirectional flow with small, regular packets after the initial handshake, consistent with interactive command execution.
   • DThe connection was initiated from the internal host to the external IP, and the external IP also received connections from other internal hosts on the same port.
   Reveal Solution Discussion Select an answer first