CND Network Forensics & Log Analysis Flashcards

Which forensic technique involves examining memory dumps to detect malware that hides from disk-based scans?

Answer: Memory forensics (RAM analysis)

Memory forensics analyzes RAM dumps to uncover fileless malware, injected code, and artifacts that never touch the disk.

What does 'log retention policy' define in an enterprise security program?

Answer: How long logs must be stored before deletion

A log retention policy specifies the minimum duration logs must be preserved to support forensic investigations, audits, and regulatory compliance.

In network forensics, what is the purpose of 'packet carving'?

Answer: Reconstructing files and data from raw packet streams

Packet carving reconstructs files, images, or documents from reassembled packet payloads captured in a PCAP file.

Which Windows artifact is most useful for determining which programs were recently executed on a system?

Answer: Prefetch files

Windows Prefetch files (.pf) record execution metadata including timestamps and run counts for recently launched programs.

What is 'log tampering' and why is it a concern in forensic investigations?

Answer: An attacker deleting or modifying logs to cover their tracks

Log tampering involves an attacker deleting, modifying, or disabling logs to erase evidence of their unauthorized activities.

Which of the following is a best practice for ensuring log integrity in a forensic context?

Answer: Forward logs in real time to a remote write-once log server

Forwarding logs in real time to an isolated, write-once remote server prevents attackers who compromise the source system from tampering with log evidence.