CHFI - Computer Hacking Forensic Investigator Network Forensics Questions and Answers

Question 1

A network forensic analyst is examining a packet capture (.pcap) file and observes a three-way handshake followed by an encrypted exchange between a client and a server.
Suddenly, the analyst sees a large number of TCP packets with the RST (Reset) flag set being sent from the server to the client.
What does this pattern most likely indicate?

Accepted Answer

An abrupt termination of the TCP connection, possibly by a firewall or Intrusion Prevention System (IPS).

Answer

A successful file transfer was completed using FTP.

Answer

A Distributed Denial of Service (DDoS) attack using a TCP SYN flood.

Answer

A normal termination of the connection using the FIN flag.

Question 2

When investigating a network security incident, a forensic analyst lacks a full packet capture but has access to NetFlow records from the organization's routers. What type of information can the analyst primarily derive from this data?

Accepted Answer

Metadata about network conversations, including source/destination IPs, ports, and the volume of data transferred.

Answer

The complete content of emails transmitted during the incident.

Answer

Specific commands executed by an attacker on a compromised host.

Answer

Cryptographic keys used to encrypt the network traffic.

Question 3

An investigator needs to capture live network traffic from a specific interface on a remote Linux server and save it to a file for later analysis. The investigator wants to use a command-line tool that is widely available and efficient. Which of the following tools is most suitable for this task?

Accepted Answer

tcpdump

Answer

Autopsy

Answer

Volatility

Answer

Network Miner

Question 4

During an investigation into a suspected malware infection, a CHFI analyst discovers an unusually high volume of DNS queries for various, seemingly random subdomains of a single parent domain (e.g., `axj34.evil.com`, `b9dk1.evil.com`). The compromised host is not receiving valid IP addresses in response. This pattern is a strong indicator of which activity?

Accepted Answer

Data exfiltration or Command and Control (C2) communication using DNS tunneling.

Answer

A DNS zone transfer attempt to enumerate all hosts in the domain.

Answer

A Distributed Denial of Service (DDoS) attack against the organization's DNS server.

Answer

A DNS amplification attack originating from the compromised host.

Question 5

A forensic investigator is analyzing a wireless packet capture and identifies a large number of deauthentication frames being broadcast. These frames appear to originate from the legitimate Access Point's MAC address but are targeting all connected clients, causing widespread disconnections. What is this specific type of attack called?

Accepted Answer

Wi-Fi Disassociation/Deauthentication Attack

Answer

Evil Twin Attack

Answer

ARP Spoofing

Answer

MAC Flooding

Question 6

Which of the following network log sources would be most valuable for an investigator trying to correlate an internal private IP address with a specific device's unique hardware address (MAC address) at a particular time?

Accepted Answer

DHCP server logs

Answer

Firewall logs

Answer

IDS/IPS logs

Answer

Web proxy logs