CCE CCE Network Forensics & Investigations

Question 1

Which protocol captures full packet data at the network level and is commonly analyzed in network forensics investigations?

Accepted Answer

PCAP (Packet Capture)

Answer

HTTP

Answer

FTP

Answer

SMTP

Question 2

In network forensics, what does a NetFlow record primarily capture?

Accepted Answer

Metadata about traffic flows between endpoints

Answer

Full packet payloads

Answer

DNS zone transfers

Answer

MAC address tables

Question 3

Which layer of the OSI model do MAC addresses belong to, and why is this relevant to network forensics?

Accepted Answer

Layer 2 – Data Link

Answer

Layer 1 – Physical

Answer

Layer 3 – Network

Answer

Layer 4 – Transport

Question 4

An investigator observes a large volume of outbound DNS queries to randomly generated domain names. This pattern most likely indicates:

Accepted Answer

Domain Generation Algorithm (DGA) malware activity

Answer

Normal recursive DNS resolution

Answer

A misconfigured DHCP server

Answer

An NTP amplification attack

Question 5

Which tool is most appropriate for reconstructing TCP sessions from a PCAP file during a network forensics investigation?

Accepted Answer

Wireshark (Follow TCP Stream)

Answer

Autopsy

Answer

Volatility

Answer

FTK Imager

Question 6

What is the primary purpose of analyzing DHCP logs in a network forensics investigation?

Accepted Answer

To correlate IP addresses with MAC addresses at specific times

Answer

To recover deleted files

Answer

To capture encrypted traffic

Answer

To identify open ports on servers