ACI ACI Network Forensics & Incident Response 1

Question 1

During a network forensics investigation, which type of log is most useful for reconstructing the timeline of a security breach?

Accepted Answer

Firewall and IDS/IPS logs

Answer

Firewall and IDS/IPS logs capture network traffic events with timestamps, making them essential for timeline reconstruction during a breach investigation.

Question 2

What is the primary purpose of capturing a memory dump at the start of an incident response investigation?

Accepted Answer

To preserve volatile data such as running processes and network connections

Answer

Memory dumps preserve volatile artifacts like active processes, open network sockets, and decrypted data that are lost when a system is powered off.

Question 3

In FTK, which feature allows an investigator to examine network packet captures alongside file system evidence?

Accepted Answer

Evidence Tree integration with PCAP parsing

Answer

FTK's evidence integration allows PCAP files to be parsed and examined alongside file system artifacts within the same case.

Question 4

Which protocol is most commonly analyzed to identify data exfiltration over encrypted channels during a network forensics review?

Accepted Answer

HTTPS/TLS

Answer

Attackers frequently use HTTPS/TLS to blend exfiltration traffic with legitimate encrypted web traffic, making TLS metadata analysis critical.

Question 5

During incident response, what is the correct order of evidence collection per the order of volatility?

Accepted Answer

CPU registers, memory, network state, hard drive

Answer

The order of volatility dictates collecting the most transient data first: CPU registers and cache → memory → network state → disk.

(ACI) AccessData Certified Investigator Practice Test

(ACI) AccessData Certified Investigator Practice Test

ACI ACI Network Forensics & Incident Response 1