CDFI CDFI Network Forensics & Traffic Analysis 1

Question 1

Which protocol is most commonly analyzed in network forensics to reconstruct TCP session data?

Accepted Answer

TCP

Answer

TCP is the primary protocol analyzed in network forensics because its three-way handshake and sequencing allow investigators to reconstruct complete sessions.

Question 2

What tool is widely used by CDFI investigators to capture and analyze live network traffic packets?

Accepted Answer

Wireshark

Answer

Wireshark is the industry-standard open-source packet analyzer used to capture and inspect live and recorded network traffic during forensic investigations.

Question 3

In network forensics, what does a 'pcap' file contain?

Accepted Answer

Raw captured network packets

Answer

A pcap (packet capture) file stores raw network packet data recorded from an interface, allowing forensic replay and analysis of network activity.

Question 4

Which NetFlow data element is most useful for identifying the volume of data transferred between two hosts?

Accepted Answer

Byte count

Answer

The byte count field in NetFlow records indicates the total bytes transferred in a flow, which is key to detecting data exfiltration.

Question 5

What is the primary purpose of analyzing DNS logs during a digital forensic investigation?

Accepted Answer

Identifying C2 communication and domain lookups

Answer

DNS logs reveal which domains hosts queried, helping investigators identify command-and-control servers, phishing domains, and data exfiltration channels.

CDFI - Certified Digital Forensics Investigator Practice Test

CDFI - Certified Digital Forensics Investigator Practice Test

CDFI CDFI Network Forensics & Traffic Analysis 1