CHFI Network Forensics 3

Question 1

Which log source would provide the most reliable evidence of an internal host performing port scanning?

Accepted Answer

Firewall or IDS/IPS logs showing repeated connection attempts

Answer

Firewall and IDS/IPS logs capture connection attempts across multiple ports and IPs, making them the best source for identifying port scanning activity.

Question 2

What does a high number of RST packets from a single source typically indicate during forensic analysis?

Accepted Answer

A port scan where the scanner receives RST responses from closed ports

Answer

TCP RST packets in response to connection attempts indicate closed ports; many RSTs from one target in response to one scanner suggest a port scanning probe.

Question 3

In HTTPS traffic analysis, what information CAN be obtained without decrypting the traffic?

Accepted Answer

Server Name Indication (SNI) hostname

Answer

SNI is transmitted in plaintext during the TLS handshake, revealing the target hostname even when payload content remains encrypted.

Question 4

A forensic analyst is examining Zeek (Bro) logs. Which log file contains records of all DNS queries and responses observed on the network?

Accepted Answer

dns.log

Answer

Zeek's dns.log records all DNS transaction details including query names, types, responses, and TTL values observed on the network.

Question 5

What is the forensic significance of identifying a 'long tail' domain (very low query frequency) in DNS logs?

Accepted Answer

It may indicate a dynamically generated domain used by malware (DGA)

Answer

Domain Generation Algorithm (DGA) malware produces rarely-seen algorithmically generated domains; these appear as 'long tail' entries with very low query counts in DNS logs.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Network Forensics 3