Network Forensics, Logging, and Event Management GCED Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An incident responder needs to capture traffic on a high-availability production network. The network uses link aggregation (LACP) between switches and servers. The responder has access to the switches and can configure SPAN. However, SPAN ports do not capture traffic on all members of an LACP bundle by default. Which of the following is the most effective approach to capture all traffic?

   • AConfigure SPAN on each physical interface in the LACP bundle and combine the captures.
   • BUse a network TAP that is inserted inline on the aggregated link.
   • CCapture traffic on the server using tcpdump, since the server sees all traffic.
   • DUse the switch's CPU to capture traffic, as it sees all packets.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst is investigating an incident and needs to correlate events from a firewall, an IDS, and a Windows server. The logs are in different formats and have different timestamps. Which of the following is the most important step to enable effective correlation?

   • AConvert all logs to PDF for easy reading.
   • BStore logs in separate databases to avoid mixing formats.
   • CUse the firewall logs as the primary source and ignore the others.
   • DNormalize the logs into a common format and ensure timestamps are synchronized to a common time source.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A forensic investigator has captured network traffic and needs to present the evidence in court. The defense attorney challenges the authenticity of the capture, claiming it may have been altered. Which of the following is the most effective way to rebut this challenge?

   • AShow that the capture file's hash matches the hash recorded at the time of capture.
   • BExplain that the capture was made using a well-known tool like Wireshark.
   • CProvide a written report of the investigation findings.
   • DState that the investigator is an expert and would not alter evidence.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company's security team is implementing a centralized logging solution. They need to ensure that logs from firewalls, IDS, and Windows servers are collected and retained for at least one year to meet compliance requirements. They also want to be able to search logs quickly during investigations. Which approach best meets these needs?

   • ADeploy a SIEM platform that ingests logs from all sources, indexes them, and provides a search interface, with a retention policy set to one year.
   • BConfigure each device to send logs via syslog to a central Linux server that stores them in flat files, and use grep for searches.
   • CStore logs locally on each device and periodically back them up to tape for archival.
   • DUse a cloud-based log storage service that only retains logs for 30 days by default.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which type of network traffic pattern is commonly associated with a port scan?

   • AA single large file transfer between two internal hosts
   • BPeriodic DNS queries to a legitimate domain
   • CMultiple connection attempts to various ports on a single host in a short time
   • DContinuous ICMP echo requests to a single host
   Reveal Solution Discussion Select an answer first