Network Forensics ECSS Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security analyst is investigating a suspected data exfiltration from a finance workstation. The analyst has a packet capture (PCAP) from the internal span port that covers the entire incident window. The workstation's system clock was later found to be 4 minutes ahead of the NTP server used by the rest of the network. Which approach best ensures that the packet timestamps are accurately correlated with firewall and proxy logs during the investigation?

   • AConvert all timestamps to UTC and compare only the date, not the time
   • BUse the packet capture's arrival time at the analysis machine as the true timestamp
   • CIgnore the workstation clock offset and rely on the firewall log timestamps as the authoritative source
   • DAdjust the PCAP timestamps by subtracting 4 minutes before correlating with other logs
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A network analyst is reviewing NetFlow records and notices that a single internal IP has established connections to over 200 different external IPs on port 445 within a 5-minute window. Each connection is short and has a small packet count. Which type of activity does this pattern most likely indicate?

   • AA network scan for vulnerable SMB servers
   • BA misconfigured DNS resolver sending queries to many servers
   • CA denial-of-service attack against the internal host
   • DA legitimate peer-to-peer application update
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the primary value of firewall logs in a network forensic investigation?

   • AThey provide the full content of network communications
   • BThey record connection attempts and decisions, helping to trace attacker actions
   • CThey replace the need for packet captures
   • DThey automatically block malicious traffic
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which network attack pattern is characterized by an attacker sending a large number of connection requests to a server to exhaust its resources?

   • AARP spoofing
   • BMan-in-the-middle attack
   • CPort scanning
   • DDenial-of-service (DoS) attack
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   When analyzing server logs in a network investigation, what is a key piece of information to look for?

   • AThe server's hardware specifications
   • BThe server's power consumption
   • CThe physical location of the server
   • DThe IP addresses of clients that accessed the server
   Reveal Solution Discussion Select an answer first