CCE CCE Network Forensics & Investigations 2 — Questions and Answers
Question 1: During a network investigation, an examiner finds traffic on port 4444. This is commonly associated with which tool?
- Apache Web Server
- Metasploit Meterpreter default listener (Correct answer)
- MySQL database
- SNMP monitoring
Correct answer: Metasploit Meterpreter default listener
Port 4444 is the default listening port for Metasploit's Meterpreter payload and is a common indicator of compromise in forensic investigations.
Question 2: What does TTL (Time to Live) manipulation in network packets potentially indicate to a forensic examiner?
- Normal routing behavior
- Possible OS fingerprinting evasion or firewall bypass attempts (Correct answer)
- Legitimate load balancing
- Standard VPN tunneling
Correct answer: Possible OS fingerprinting evasion or firewall bypass attempts
Abnormal TTL values can indicate OS fingerprinting evasion, firewall bypass techniques, or packet crafting by an attacker.
Question 3: In network forensics, what is a 'pivot' host?
- A dedicated forensic workstation
- A compromised system used as a relay to attack internal network resources (Correct answer)
- A network load balancer
- A backup DNS server
Correct answer: A compromised system used as a relay to attack internal network resources
A pivot host is a compromised system that attackers use as a launching point to reach other network segments or systems that are not directly accessible.
Question 4: Which type of log would a CCE examiner most likely review to determine whether an attacker exfiltrated data via HTTP?
- Windows Event Logs
- Web proxy or web server access logs (Correct answer)
- BIOS event logs
- Active Directory replication logs
Correct answer: Web proxy or web server access logs
Web proxy and server access logs record HTTP/HTTPS requests, URLs, user agents, response codes, and transferred bytes useful for detecting data exfiltration.
Question 5: What is DNS tunneling, and why is it significant in CCE investigations?
- Encrypting DNS queries with TLS
- Encoding data within DNS queries/responses to covertly exfiltrate data or establish C2 channels (Correct answer)
- Redirecting DNS traffic through a VPN
- Caching DNS records locally
Correct answer: Encoding data within DNS queries/responses to covertly exfiltrate data or establish C2 channels
DNS tunneling encodes arbitrary data within DNS traffic to bypass firewalls and exfiltrate data or communicate with command-and-control servers covertly.
Question 6: An examiner captures HTTPS traffic in a corporate environment and cannot read the payload. What is the most forensically sound approach to decrypt this traffic?
- Use brute force on the encryption key
- Obtain the server's private key or pre-master secret log from the server's TLS configuration (Correct answer)
- Ignore encrypted traffic as it is not admissible
- Capture at the physical layer instead
Correct answer: Obtain the server's private key or pre-master secret log from the server's TLS configuration
With access to the server's private key or the pre-master secret log (e.g., from a corporate SSL inspection proxy), investigators can decrypt TLS traffic in tools like Wireshark.
CCE CCE Network Forensics & Investigations 2
During a network investigation, an examiner finds traffic on port 4444.
This is commonly associated with which tool?