CHFI Network Forensics 5

Question 1

In the context of wireless network forensics, what does a 'deauthentication flood' attack leave as evidence in wireless packet captures?

Accepted Answer

High volume of deauthentication frames from a spoofed BSSID

Answer

A deauthentication flood generates massive quantities of 802.11 deauth management frames with a spoofed source BSSID, forcing clients offline; these frames are clearly visible in wireless captures.

Question 2

Which network forensics artifact would best help an investigator determine the exact time a specific external IP address first communicated with an internal host?

Accepted Answer

Firewall log timestamps for the first allowed session

Answer

Firewall logs record timestamped allow/deny decisions for every connection attempt, providing the most reliable record of when external communication with an internal host first occurred.

Question 3

What is 'passive OS fingerprinting' in network forensics?

Accepted Answer

Identifying operating systems by analyzing characteristics of traffic they generate without sending probes

Answer

Passive OS fingerprinting identifies remote operating systems by analyzing observable TCP/IP stack characteristics (TTL values, TCP window sizes, flag combinations) in captured traffic without generating any probe traffic.

Question 4

An analyst captures traffic and notices that HTTP responses contain an unusually large number of Set-Cookie headers with random-looking values. This may indicate:

Accepted Answer

Cookie-based data exfiltration or C2 channel using HTTP

Answer

Malware can use HTTP cookies to smuggle data and commands between compromised hosts and C2 servers, with encoded payloads embedded in seemingly legitimate cookie values.

Question 5

Which forensic evidence would confirm that a VPN tunnel was established between two hosts, even if the tunneled content is encrypted?

Accepted Answer

Presence of encapsulating protocols such as GRE, ESP, or OpenVPN's UDP traffic on known VPN ports

Answer

VPN protocols leave identifiable traces such as ESP (IPsec), GRE encapsulation headers, or UDP traffic on well-known VPN ports (e.g., 1194 for OpenVPN, 500/4500 for IKE) even when payload is encrypted.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Network Forensics 5