CHFI Network Forensics 3 — Questions and Answers
Question 1: Which log source would provide the most reliable evidence of an internal host performing port scanning?
- Web server access logs
- Firewall or IDS/IPS logs showing repeated connection attempts (Correct answer)
- DHCP lease logs
- Email server logs
Correct answer: Firewall or IDS/IPS logs showing repeated connection attempts
Firewall and IDS/IPS logs capture connection attempts across multiple ports and IPs, making them the best source for identifying port scanning activity.
Question 2: What does a high number of RST packets from a single source typically indicate during forensic analysis?
- A busy web server handling many requests
- A port scan where the scanner receives RST responses from closed ports (Correct answer)
- Normal TCP session termination
- Successful SSL handshakes
Correct answer: A port scan where the scanner receives RST responses from closed ports
TCP RST packets in response to connection attempts indicate closed ports; many RSTs from one target in response to one scanner suggest a port scanning probe.
Question 3: In HTTPS traffic analysis, what information CAN be obtained without decrypting the traffic?
- HTTP request headers
- Cookie values
- Server Name Indication (SNI) hostname (Correct answer)
- POST request body content
Correct answer: Server Name Indication (SNI) hostname
SNI is transmitted in plaintext during the TLS handshake, revealing the target hostname even when payload content remains encrypted.
Question 4: A forensic analyst is examining Zeek (Bro) logs. Which log file contains records of all DNS queries and responses observed on the network?
- conn.log
- http.log
- dns.log (Correct answer)
- notice.log
Correct answer: dns.log
Zeek's dns.log records all DNS transaction details including query names, types, responses, and TTL values observed on the network.
Question 5: What is the forensic significance of identifying a 'long tail' domain (very low query frequency) in DNS logs?
- It indicates a popular CDN endpoint
- It may indicate a dynamically generated domain used by malware (DGA) (Correct answer)
- It is a sign of legitimate load balancing
- It indicates a misconfigured resolver
Correct answer: It may indicate a dynamically generated domain used by malware (DGA)
Domain Generation Algorithm (DGA) malware produces rarely-seen algorithmically generated domains; these appear as 'long tail' entries with very low query counts in DNS logs.
Question 6: Which command-line tool is used to display active network connections and their associated process IDs on a Windows system?
- ipconfig /all
- netstat -ano (Correct answer)
- arp -a
- route print
Correct answer: netstat -ano
`netstat -ano` shows all active TCP/UDP connections, listening ports, and the PID of the owning process on Windows systems.
Question 7: When analyzing a suspect's network traffic, an investigator observes large ICMP packets with payloads containing structured data. This suggests:
- Normal network diagnostics
- ICMP tunneling for covert data exfiltration (Correct answer)
- IPv6 transition mechanism
- Fragmentation reassembly issues
Correct answer: ICMP tunneling for covert data exfiltration
ICMP tunneling embeds data inside ICMP echo request/reply payloads, exploiting protocols often allowed through firewalls to create a covert communication channel.
CHFI Network Forensics 3
Which log source would provide the most reliable evidence of an internal host performing port scanning?