CHFI Network Forensics 2

Question 1

Which protocol is primarily analyzed when investigating DNS-based data exfiltration attacks?

Accepted Answer

DNS

Answer

DNS tunneling encodes data within DNS query/response payloads to exfiltrate data, making DNS traffic the primary focus of such investigations.

Question 2

A forensic investigator captures a packet with TTL value of 1. What does this most likely indicate?

Accepted Answer

The packet was crafted to expire after one hop

Answer

A TTL of 1 means the packet will be dropped after crossing one router, often seen in traceroute probes or deliberately crafted reconnaissance packets.

Question 3

Which Wireshark display filter would isolate only TCP SYN packets without ACK flags?

Accepted Answer

tcp.flags.syn == 1 && tcp.flags.ack == 0

Answer

The filter `tcp.flags.syn == 1 && tcp.flags.ack == 0` precisely isolates TCP SYN packets that initiate connections without an acknowledgment flag.

Question 4

During a network forensics investigation, an analyst notices many short-duration flows to a single external IP. This pattern is most consistent with:

Accepted Answer

Beaconing malware behavior

Answer

Regular short-duration connections to a single external IP at consistent intervals are a hallmark of malware beaconing for command-and-control communication.

Question 5

What is the primary purpose of NetFlow data in network forensics?

Accepted Answer

Providing summarized metadata about network traffic flows

Answer

NetFlow records summarize traffic flow metadata (source/destination IPs, ports, byte counts, timestamps) without capturing full payloads, enabling efficient large-scale traffic analysis.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Network Forensics 2