CDFI CDFI Network Forensics & Traffic Analysis 2

Question 1

Which log source is BEST for correlating multiple network events across an enterprise during a forensic investigation?

Accepted Answer

SIEM (Security Information and Event Management) system

Answer

Individual host event logs

Answer

Router ARP tables

Answer

DHCP lease files

Question 2

What is 'IP geolocation' used for in network forensics?

Accepted Answer

Estimating the physical location of an IP address

Answer

Encrypting captured traffic

Answer

Assigning static IPs to servers

Answer

Measuring network latency

Question 3

When investigating a potential data exfiltration event, which traffic characteristic is most suspicious?

Accepted Answer

Large outbound transfers to unknown external IPs at night

Answer

High inbound traffic volume during business hours

Answer

Low-latency DNS responses

Answer

Consistent HTTP GET requests to known CDNs

Question 4

Which technique allows a forensic investigator to reassemble fragmented IP packets for analysis?

Accepted Answer

Packet defragmentation

Answer

ARP spoofing

Answer

NAT traversal

Answer

Deep packet inspection filtering

Question 5

What does TLS/SSL decryption capability allow a forensic investigator to do during network analysis?

Accepted Answer

Inspect the plaintext content of encrypted sessions

Answer

Block suspicious traffic automatically

Answer

Create digital signatures

Answer

Restore deleted network logs

Question 6

In network forensics, what is the significance of a 'golden ticket' attack in Kerberos traffic logs?

Accepted Answer

It means an attacker forged a Kerberos TGT for persistent unauthorized access

Answer

It indicates a successful patch update

Answer

It marks normal load-balancer behavior

Answer

It identifies a DNS misconfiguration