Data on the Network GBFA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A forensic investigator is asked to capture network traffic from a public Wi-Fi network to investigate a cybercrime. The investigator does not have a warrant but has the network administrator's permission. Which action is most appropriate?

   • ACapture all traffic and later filter out irrelevant data.
   • BCapture the traffic because the network administrator gave permission.
   • CDo not capture traffic until a warrant or other legal authorization is obtained, as capturing traffic on a public network may violate privacy laws.
   • DCapture only the traffic of the suspected individual, as it is targeted.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A forensic examiner has completed a network capture and needs to document the evidence for legal proceedings. What is the minimum documentation required to establish a proper chain of custody?

   • AA list of all tools used during the capture.
   • BA timestamp of when the capture was started and stopped.
   • CA description of the network topology and the capture point.
   • DA log recording who handled the evidence, when, and for what purpose, along with a hash of the capture file.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   An examiner is analyzing a packet capture and sees a TCP connection that uses a sequence of packets with the PSH flag set. The data in the packets appears to be fragmented across multiple segments. What is the most likely reason for the PSH flag being set?

   • AThe packets are part of a TCP retransmission.
   • BThe packets are part of a TCP keepalive.
   • CThe packets are part of a TCP window update.
   • DThe sending application is pushing data to the receiving application immediately without waiting for the buffer to fill.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is an ethical consideration when handling network evidence?

   • AUsing the most aggressive capture techniques
   • BDeleting evidence that is not directly relevant
   • CSharing the captured data with all team members
   • DMinimizing the capture of unrelated personal data
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   In a pcap, you observe a large number of ICMP Echo Request packets sent to a broadcast address, with the source IP spoofed to a victim's address. What is the most likely purpose of this traffic?

   • AA misconfigured router sending ICMP redirects.
   • BA normal network discovery scan using ping sweeps.
   • CA DNS amplification attack using ICMP.
   • DA Smurf attack, using the broadcast address to amplify traffic to the victim.
   Reveal Solution Discussion Select an answer first