CHFI Network Forensics 2 — Questions and Answers
Question 1: Which protocol is primarily analyzed when investigating DNS-based data exfiltration attacks?
- HTTPS
- DNS (Correct answer)
- FTP
- SMTP
Correct answer: DNS
DNS tunneling encodes data within DNS query/response payloads to exfiltrate data, making DNS traffic the primary focus of such investigations.
Question 2: A forensic investigator captures a packet with TTL value of 1. What does this most likely indicate?
- The packet originated from a local subnet
- The packet was crafted to expire after one hop (Correct answer)
- The packet is encrypted
- The packet uses IPv6
Correct answer: The packet was crafted to expire after one hop
A TTL of 1 means the packet will be dropped after crossing one router, often seen in traceroute probes or deliberately crafted reconnaissance packets.
Question 3: Which Wireshark display filter would isolate only TCP SYN packets without ACK flags?
- tcp.flags == 0x02
- tcp.flags.syn == 1 && tcp.flags.ack == 0 (Correct answer)
- tcp.flags.ack == 0
- tcp.handshake == syn
Correct answer: tcp.flags.syn == 1 && tcp.flags.ack == 0
The filter `tcp.flags.syn == 1 && tcp.flags.ack == 0` precisely isolates TCP SYN packets that initiate connections without an acknowledgment flag.
Question 4: During a network forensics investigation, an analyst notices many short-duration flows to a single external IP. This pattern is most consistent with:
- Normal web browsing
- Beaconing malware behavior (Correct answer)
- VoIP communications
- File transfer protocol activity
Correct answer: Beaconing malware behavior
Regular short-duration connections to a single external IP at consistent intervals are a hallmark of malware beaconing for command-and-control communication.
Question 5: What is the primary purpose of NetFlow data in network forensics?
- Capturing full packet payloads for deep inspection
- Providing summarized metadata about network traffic flows (Correct answer)
- Decrypting SSL/TLS sessions
- Mapping physical network topology
Correct answer: Providing summarized metadata about network traffic flows
NetFlow records summarize traffic flow metadata (source/destination IPs, ports, byte counts, timestamps) without capturing full payloads, enabling efficient large-scale traffic analysis.
Question 6: An investigator finds ARP replies with no preceding ARP request in a packet capture. This is a sign of:
- Normal router behavior
- ARP cache poisoning (Correct answer)
- DHCP spoofing
- DNS hijacking
Correct answer: ARP cache poisoning
Unsolicited ARP replies (gratuitous ARP) sent by an attacker are the primary mechanism of ARP cache poisoning, used to associate the attacker's MAC with a legitimate IP.
Question 7: Which tool is specifically designed for reconstructing TCP streams from packet captures to recover transferred files?
- Nmap
- NetworkMiner (Correct answer)
- Aircrack-ng
- Metasploit
Correct answer: NetworkMiner
NetworkMiner passively captures packets and automatically reassembles TCP streams to extract transferred files, credentials, and messages from network traffic.
CHFI Network Forensics 2
Which protocol is primarily analyzed when investigating DNS-based data exfiltration attacks?