CCE CCE Network Forensics & Investigations 2

Question 1

During a network investigation, an examiner finds traffic on port 4444. This is commonly associated with which tool?

Accepted Answer

Metasploit Meterpreter default listener

Answer

Port 4444 is the default listening port for Metasploit's Meterpreter payload and is a common indicator of compromise in forensic investigations.

Question 2

What does TTL (Time to Live) manipulation in network packets potentially indicate to a forensic examiner?

Accepted Answer

Possible OS fingerprinting evasion or firewall bypass attempts

Answer

Abnormal TTL values can indicate OS fingerprinting evasion, firewall bypass techniques, or packet crafting by an attacker.

Question 3

In network forensics, what is a 'pivot' host?

Accepted Answer

A compromised system used as a relay to attack internal network resources

Answer

A pivot host is a compromised system that attackers use as a launching point to reach other network segments or systems that are not directly accessible.

Question 4

Which type of log would a CCE examiner most likely review to determine whether an attacker exfiltrated data via HTTP?

Accepted Answer

Web proxy or web server access logs

Answer

Web proxy and server access logs record HTTP/HTTPS requests, URLs, user agents, response codes, and transferred bytes useful for detecting data exfiltration.

Question 5

What is DNS tunneling, and why is it significant in CCE investigations?

Accepted Answer

Encoding data within DNS queries/responses to covertly exfiltrate data or establish C2 channels

Answer

DNS tunneling encodes arbitrary data within DNS traffic to bypass firewalls and exfiltrate data or communicate with command-and-control servers covertly.

(CCE) Certified Computer Examiner Practice Test

(CCE) Certified Computer Examiner Practice Test

CCE CCE Network Forensics & Investigations 2