CDFI CDFI Network Forensics & Traffic Analysis 3

Question 1

Which protocol uses port 443 and is commonly scrutinized in network forensics for tunneling malicious traffic?

Accepted Answer

HTTPS/TLS

Answer

HTTPS on port 443 is commonly abused by attackers to tunnel C2 traffic because it blends with legitimate encrypted web traffic and is rarely blocked.

Question 2

What is the purpose of examining 'beaconing' patterns in network traffic during a forensic investigation?

Accepted Answer

Identifying malware that regularly contacts a C2 server at fixed intervals

Answer

Beaconing—regular, periodic outbound connections at consistent time intervals—is a hallmark of malware checking in with a command-and-control server.

Question 3

During network forensics, what does analyzing 'TTL (Time to Live)' values help investigators determine?

Accepted Answer

The approximate number of network hops a packet traversed

Answer

TTL decrements by one at each router hop; by examining the TTL in captured packets, investigators can estimate how many network hops the traffic traveled.

Question 4

What is 'flow analysis' in the context of network forensics?

Accepted Answer

Reviewing summarized metadata about network conversations without full packet contents

Answer

Flow analysis examines NetFlow/IPFIX metadata (source, destination, ports, bytes, duration) to detect anomalies without needing full packet payloads.

Question 5

Which forensic artifact from a firewall is most valuable for reconstructing an attacker's lateral movement through a network?

Accepted Answer

Firewall connection logs showing accepted/denied traffic between internal hosts

Answer

Firewall connection logs record accepted and denied traffic between hosts, allowing investigators to trace an attacker's path as they moved laterally across the network.

CDFI - Certified Digital Forensics Investigator Practice Test

CDFI - Certified Digital Forensics Investigator Practice Test

CDFI CDFI Network Forensics & Traffic Analysis 3