ACI ACI Network Forensics & Incident Response 1 — Questions and Answers
Question 1: During a network forensics investigation, which type of log is most useful for reconstructing the timeline of a security breach?
- Application error logs
- Firewall and IDS/IPS logs (Correct answer)
- Printer spool logs
- Font cache logs
Correct answer: Firewall and IDS/IPS logs
Firewall and IDS/IPS logs capture network traffic events with timestamps, making them essential for timeline reconstruction during a breach investigation.
Question 2: What is the primary purpose of capturing a memory dump at the start of an incident response investigation?
- To free up RAM for forensic tools
- To preserve volatile data such as running processes and network connections (Correct answer)
- To create a backup of the hard drive
- To reset the system to a clean state
Correct answer: To preserve volatile data such as running processes and network connections
Memory dumps preserve volatile artifacts like active processes, open network sockets, and decrypted data that are lost when a system is powered off.
Question 3: In FTK, which feature allows an investigator to examine network packet captures alongside file system evidence?
- Registry Viewer
- Evidence Tree integration with PCAP parsing (Correct answer)
- Bookmark Manager
- Hash Set Manager
Correct answer: Evidence Tree integration with PCAP parsing
FTK's evidence integration allows PCAP files to be parsed and examined alongside file system artifacts within the same case.
Question 4: Which protocol is most commonly analyzed to identify data exfiltration over encrypted channels during a network forensics review?
- FTP
- HTTPS/TLS (Correct answer)
- SMTP
- DHCP
Correct answer: HTTPS/TLS
Attackers frequently use HTTPS/TLS to blend exfiltration traffic with legitimate encrypted web traffic, making TLS metadata analysis critical.
Question 5: During incident response, what is the correct order of evidence collection per the order of volatility?
- Hard drive, memory, network state, CPU registers
- CPU registers, memory, network state, hard drive (Correct answer)
- Network state, hard drive, memory, CPU registers
- Memory, hard drive, CPU registers, network state
Correct answer: CPU registers, memory, network state, hard drive
The order of volatility dictates collecting the most transient data first: CPU registers and cache → memory → network state → disk.
Question 6: What does an abnormally high volume of DNS queries to a single external domain indicate during a network investigation?
- Normal web browsing activity
- Possible DNS tunneling or command-and-control communication (Correct answer)
- A misconfigured DHCP server
- Routine OS update traffic
Correct answer: Possible DNS tunneling or command-and-control communication
Excessive DNS queries to one domain are a hallmark of DNS tunneling, where attackers encode C2 communications or exfiltrated data in DNS requests.
ACI ACI Network Forensics & Incident Response 1
During a network forensics investigation, which type of log is most useful for reconstructing the timeline of a security breach?