CCE CCE Network Forensics & Investigations 1 — Questions and Answers
Question 1: Which protocol captures full packet data at the network level and is commonly analyzed in network forensics investigations?
- PCAP (Packet Capture) (Correct answer)
- HTTP
- FTP
- SMTP
Correct answer: PCAP (Packet Capture)
PCAP files store full packet data captured from network interfaces and are the standard format analyzed by tools like Wireshark in network forensics.
Question 2: In network forensics, what does a NetFlow record primarily capture?
- Full packet payloads
- Metadata about traffic flows between endpoints (Correct answer)
- DNS zone transfers
- MAC address tables
Correct answer: Metadata about traffic flows between endpoints
NetFlow records capture metadata such as source/destination IPs, ports, protocol, and byte counts without storing full packet contents.
Question 3: Which layer of the OSI model do MAC addresses belong to, and why is this relevant to network forensics?
- Layer 1 – Physical
- Layer 2 – Data Link (Correct answer)
- Layer 3 – Network
- Layer 4 – Transport
Correct answer: Layer 2 – Data Link
MAC addresses operate at Layer 2 (Data Link) and can help investigators identify specific network interface cards involved in an incident.
Question 4: An investigator observes a large volume of outbound DNS queries to randomly generated domain names. This pattern most likely indicates:
- Normal recursive DNS resolution
- Domain Generation Algorithm (DGA) malware activity (Correct answer)
- A misconfigured DHCP server
- An NTP amplification attack
Correct answer: Domain Generation Algorithm (DGA) malware activity
Domain Generation Algorithms (DGAs) are used by malware to generate pseudo-random domain names to contact command-and-control servers while evading blacklists.
Question 5: Which tool is most appropriate for reconstructing TCP sessions from a PCAP file during a network forensics investigation?
- Autopsy
- Wireshark (Follow TCP Stream) (Correct answer)
- Volatility
- FTK Imager
Correct answer: Wireshark (Follow TCP Stream)
Wireshark's 'Follow TCP Stream' feature reassembles the full conversation from individual TCP packets for analysis.
Question 6: What is the primary purpose of analyzing DHCP logs in a network forensics investigation?
- To recover deleted files
- To correlate IP addresses with MAC addresses at specific times (Correct answer)
- To capture encrypted traffic
- To identify open ports on servers
Correct answer: To correlate IP addresses with MAC addresses at specific times
DHCP logs record which MAC address was assigned which IP address and when, enabling investigators to link network activity to a physical device.
CCE CCE Network Forensics & Investigations 1
Which protocol captures full packet data at the network level and is commonly analyzed in network forensics investigations?