CND Network Forensics & Log Analysis Flashcards

What is the significance of timestamps in log analysis during a forensic investigation?

Answer: They establish the sequence and timing of events

Accurate timestamps allow investigators to build a chronological timeline correlating events across multiple systems.

Which protocol is designed to forward log messages from network devices to a central log server?

Answer: Syslog

Syslog (RFC 5424) is the standard protocol used by routers, switches, firewalls, and servers to send log messages to a centralized log server.

In network forensics, what does 'log normalization' refer to?

Answer: Converting logs from different sources into a common format

Log normalization transforms heterogeneous log formats from various devices and applications into a unified schema for consistent analysis.

What is a 'honeypot' used for in network forensics and threat analysis?

Answer: Luring attackers to study their techniques

A honeypot is a deliberately vulnerable decoy system designed to attract attackers so their methods and tools can be observed and analyzed.

Which of the following best describes 'volatile evidence' in digital forensics?

Answer: Data that is lost when the system is powered off, such as RAM contents

Volatile evidence such as RAM contents, running processes, and network connections exists only while the system is powered on and is lost upon shutdown.

What is the primary forensic use of NetFlow data collected from routers?

Answer: Identify communication patterns and detect anomalies without capturing full payloads

NetFlow records metadata (IPs, ports, bytes, duration) about network conversations, enabling anomaly detection without storing full packet payloads.