Digital Forensics Concepts and Application GCED Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company's legal team needs to prove that an employee exfiltrated sensitive data over the network. The company has network logs but no full packet capture. The legal team wants to reconstruct the exact data that was sent. Which approach is most likely to satisfy the legal requirement?

   • AUse the firewall logs to prove the data was encrypted and therefore cannot be reconstructed.
   • BReconstruct the data from the network logs by decoding the packets.
   • CUse the network logs to identify the connection and then request the data from the employee's machine.
   • DAnalyze the network logs to show the timing and size of the transfer, and correlate with other evidence.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of network forensics?

   • ATo encrypt all network communications.
   • BTo capture and analyze network traffic to identify malicious activity and reconstruct events.
   • CTo block malicious traffic in real time.
   • DTo recover deleted files from network-attached storage.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the first step in performing memory forensics on a live system?

   • AAnalyzing the memory dump for malware signatures.
   • BAcquiring a memory dump from the system.
   • CShutting down the system to preserve the memory.
   • DDocumenting the findings in a report.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A network administrator suspects that an attacker is using DNS tunneling to exfiltrate data. The administrator has access to the corporate DNS server logs. Which analysis technique would best confirm DNS tunneling?

   • AExamine the DNS server's cache for recently resolved names.
   • BCheck for DNS queries to well-known legitimate domains.
   • CLook for DNS queries with unusually long subdomains and high query volume to a single domain.
   • DReview the firewall logs for blocked outbound connections.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A forensic team is collecting evidence from a corporate network that spans multiple time zones. The team must document the chain of custody for several servers. Which practice is MOST important to ensure the chain of custody is legally valid?

   • ARely on the security team's access badges to prove who accessed the evidence room.
   • BUse local time for each server's location to match the server logs.
   • CRecord the date and time in UTC for every evidence handling event, along with the name and role of each person.
   • DHave each team member sign a single log sheet at the end of the investigation.
   Reveal Solution Discussion Select an answer first