CND CND Network Forensics & Log Analysis 2 — Questions and Answers
Question 1: What is the significance of timestamps in log analysis during a forensic investigation?
- They determine log file size
- They establish the sequence and timing of events (Correct answer)
- They encrypt log entries
- They compress log data
Correct answer: They establish the sequence and timing of events
Accurate timestamps allow investigators to build a chronological timeline correlating events across multiple systems.
Question 2: Which protocol is designed to forward log messages from network devices to a central log server?
- SNMP
- Syslog (Correct answer)
- RADIUS
- TACACS+
Correct answer: Syslog
Syslog (RFC 5424) is the standard protocol used by routers, switches, firewalls, and servers to send log messages to a centralized log server.
Question 3: In network forensics, what does 'log normalization' refer to?
- Deleting redundant log entries
- Converting logs from different sources into a common format (Correct answer)
- Encrypting log files at rest
- Compressing log archives
Correct answer: Converting logs from different sources into a common format
Log normalization transforms heterogeneous log formats from various devices and applications into a unified schema for consistent analysis.
Question 4: What is a 'honeypot' used for in network forensics and threat analysis?
- Storing encrypted credentials
- Luring attackers to study their techniques (Correct answer)
- Caching web content
- Distributing software patches
Correct answer: Luring attackers to study their techniques
A honeypot is a deliberately vulnerable decoy system designed to attract attackers so their methods and tools can be observed and analyzed.
Question 5: Which of the following best describes 'volatile evidence' in digital forensics?
- Evidence stored on encrypted hard drives
- Data that is lost when the system is powered off, such as RAM contents (Correct answer)
- Log files on a NAS device
- Archived email stored on a mail server
Correct answer: Data that is lost when the system is powered off, such as RAM contents
Volatile evidence such as RAM contents, running processes, and network connections exists only while the system is powered on and is lost upon shutdown.
Question 6: What is the primary forensic use of NetFlow data collected from routers?
- Decrypt SSL traffic
- Identify communication patterns and detect anomalies without capturing full payloads (Correct answer)
- Authenticate remote users
- Distribute DHCP leases
Correct answer: Identify communication patterns and detect anomalies without capturing full payloads
NetFlow records metadata (IPs, ports, bytes, duration) about network conversations, enabling anomaly detection without storing full packet payloads.
CND CND Network Forensics & Log Analysis 2
What is the significance of timestamps in log analysis during a forensic investigation?