CND Network Forensics & Log Analysis Flashcards

Which log type is most useful for reconstructing a timeline of network intrusion events?

Answer: Network flow (NetFlow/IPFIX) logs

Network flow logs capture source/destination IP, ports, timestamps, and byte counts, making them ideal for reconstructing intrusion timelines.

What is the primary purpose of a Security Information and Event Management (SIEM) system in network forensics?

Answer: Correlate and aggregate log data for real-time analysis

A SIEM centralizes log collection from multiple sources and applies correlation rules to detect suspicious patterns in real time.

Which tool is commonly used for capturing and analyzing raw network packets during forensic investigation?

Answer: Wireshark

Wireshark is the industry-standard open-source packet analyzer used to capture and inspect raw network traffic during forensic investigations.

What does the term 'chain of custody' mean in the context of network forensics?

Answer: Documented handling of evidence from collection to court presentation

Chain of custody documents every person who handled digital evidence and every action taken, ensuring admissibility in legal proceedings.

When analyzing logs, what is a 'false positive' in the context of an IDS alert?

Answer: A legitimate activity incorrectly flagged as malicious

A false positive occurs when an IDS triggers an alert on benign traffic that matches a malicious signature pattern.

Which Windows event log ID is associated with a successful user logon?

Answer: 4624

Windows Event ID 4624 is generated each time a user successfully logs on to the system.