CHFI Network Forensics 4

Question 1

What does the 'conversation' view in Wireshark primarily help an investigator accomplish?

Accepted Answer

Identify all unique bidirectional communication pairs in a capture

Answer

Wireshark's Conversations window displays all unique endpoint pairs communicating in the capture, showing statistics like packet counts and bytes exchanged per conversation.

Question 2

During investigation, an analyst finds that a system sent a DHCP request claiming to be a different device's MAC address. This attack is called:

Accepted Answer

MAC spoofing

Answer

MAC spoofing involves changing the source MAC address in frames to impersonate another device, which can be detected by comparing DHCP requests against switch MAC address tables.

Question 3

Which RFC defines the syslog protocol commonly used to collect network device logs for forensic analysis?

Accepted Answer

RFC 5424

Answer

RFC 5424 defines the current syslog protocol standard, specifying the format for system log messages used by network devices, servers, and security appliances.

Question 4

An investigator wants to determine all websites visited by a user using only proxy server logs. Which log field is most critical for this analysis?

Accepted Answer

Requested URL or CONNECT hostname

Answer

The requested URL or CONNECT hostname in proxy logs directly identifies which web resources the client accessed, making it the primary field for website visit reconstruction.

Question 5

What network forensics technique involves correlating traffic across multiple capture points to trace the path of an attacker through the network?

Accepted Answer

Traffic path reconstruction

Answer

Traffic path reconstruction correlates timestamps and connection metadata from multiple network taps or logs to trace how an attacker moved laterally through network segments.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Network Forensics 4