CDFI CDFI Network Forensics & Traffic Analysis 3

Question 1

Which protocol uses port 443 and is commonly scrutinized in network forensics for tunneling malicious traffic?

Accepted Answer

HTTPS/TLS

Answer

FTP

Answer

Telnet

Answer

SNMP

Question 2

What is the purpose of examining 'beaconing' patterns in network traffic during a forensic investigation?

Accepted Answer

Identifying malware that regularly contacts a C2 server at fixed intervals

Answer

Measuring network bandwidth utilization

Answer

Auditing firewall rule changes

Answer

Tracking legitimate software updates

Question 3

During network forensics, what does analyzing 'TTL (Time to Live)' values help investigators determine?

Accepted Answer

The approximate number of network hops a packet traversed

Answer

The age of a file on disk

Answer

The encryption algorithm used

Answer

The session cookie expiration time

Question 4

What is 'flow analysis' in the context of network forensics?

Accepted Answer

Reviewing summarized metadata about network conversations without full packet contents

Answer

Examining physical cable connections

Answer

Recovering corrupted network logs

Answer

Analyzing application source code

Question 5

Which forensic artifact from a firewall is most valuable for reconstructing an attacker's lateral movement through a network?

Accepted Answer

Firewall connection logs showing accepted/denied traffic between internal hosts

Answer

DHCP lease duration settings

Answer

DNS TTL cache entries

Answer

SSL certificate expiration dates

Question 6

In a CDFI investigation, what is the primary concern when using a 'man-in-the-middle' proxy to decrypt TLS traffic for analysis?

Accepted Answer

Legal and privacy authorization to intercept encrypted communications

Answer

Increased disk storage requirements

Answer

Slower network throughput

Answer

Compatibility with legacy protocols