CDFI CDFI Network Forensics & Traffic Analysis 2

Question 1

Which log source is BEST for correlating multiple network events across an enterprise during a forensic investigation?

Accepted Answer

SIEM (Security Information and Event Management) system

Answer

A SIEM aggregates and correlates logs from multiple sources enterprise-wide, making it the best tool for building a timeline of network-based incidents.

Question 2

What is 'IP geolocation' used for in network forensics?

Accepted Answer

Estimating the physical location of an IP address

Answer

IP geolocation maps an IP address to an approximate geographic location, helping investigators identify the origin of malicious traffic.

Question 3

When investigating a potential data exfiltration event, which traffic characteristic is most suspicious?

Accepted Answer

Large outbound transfers to unknown external IPs at night

Answer

Large outbound data transfers to unknown IPs during off-hours is a classic indicator of data exfiltration that warrants deep forensic investigation.

Question 4

Which technique allows a forensic investigator to reassemble fragmented IP packets for analysis?

Accepted Answer

Packet defragmentation

Answer

Packet defragmentation reassembles split IP datagrams in the correct order so investigators can examine the complete payload of transmitted data.

Question 5

What does TLS/SSL decryption capability allow a forensic investigator to do during network analysis?

Accepted Answer

Inspect the plaintext content of encrypted sessions

Answer

With access to private keys or using a MITM proxy, TLS decryption lets investigators read the actual plaintext content of otherwise encrypted communications.

CDFI - Certified Digital Forensics Investigator Practice Test

CDFI - Certified Digital Forensics Investigator Practice Test

CDFI CDFI Network Forensics & Traffic Analysis 2