CCE CCE Network Forensics & Investigations 1

Question 1

Which protocol captures full packet data at the network level and is commonly analyzed in network forensics investigations?

Accepted Answer

PCAP (Packet Capture)

Answer

PCAP files store full packet data captured from network interfaces and are the standard format analyzed by tools like Wireshark in network forensics.

Question 2

In network forensics, what does a NetFlow record primarily capture?

Accepted Answer

Metadata about traffic flows between endpoints

Answer

NetFlow records capture metadata such as source/destination IPs, ports, protocol, and byte counts without storing full packet contents.

Question 3

Which layer of the OSI model do MAC addresses belong to, and why is this relevant to network forensics?

Accepted Answer

Layer 2 – Data Link

Answer

MAC addresses operate at Layer 2 (Data Link) and can help investigators identify specific network interface cards involved in an incident.

Question 4

An investigator observes a large volume of outbound DNS queries to randomly generated domain names. This pattern most likely indicates:

Accepted Answer

Domain Generation Algorithm (DGA) malware activity

Answer

Domain Generation Algorithms (DGAs) are used by malware to generate pseudo-random domain names to contact command-and-control servers while evading blacklists.

Question 5

Which tool is most appropriate for reconstructing TCP sessions from a PCAP file during a network forensics investigation?

Accepted Answer

Wireshark (Follow TCP Stream)

Answer

Wireshark's 'Follow TCP Stream' feature reassembles the full conversation from individual TCP packets for analysis.

(CCE) Certified Computer Examiner Practice Test

(CCE) Certified Computer Examiner Practice Test

CCE CCE Network Forensics & Investigations 1