CND CND Network Forensics & Log Analysis 2

Question 1

What is the significance of timestamps in log analysis during a forensic investigation?

Accepted Answer

They establish the sequence and timing of events

Answer

Accurate timestamps allow investigators to build a chronological timeline correlating events across multiple systems.

Question 2

Which protocol is designed to forward log messages from network devices to a central log server?

Accepted Answer

Syslog

Answer

Syslog (RFC 5424) is the standard protocol used by routers, switches, firewalls, and servers to send log messages to a centralized log server.

Question 3

In network forensics, what does 'log normalization' refer to?

Accepted Answer

Converting logs from different sources into a common format

Answer

Log normalization transforms heterogeneous log formats from various devices and applications into a unified schema for consistent analysis.

Question 4

What is a 'honeypot' used for in network forensics and threat analysis?

Accepted Answer

Luring attackers to study their techniques

Answer

A honeypot is a deliberately vulnerable decoy system designed to attract attackers so their methods and tools can be observed and analyzed.

Question 5

Which of the following best describes 'volatile evidence' in digital forensics?

Accepted Answer

Data that is lost when the system is powered off, such as RAM contents

Answer

Volatile evidence such as RAM contents, running processes, and network connections exists only while the system is powered on and is lost upon shutdown.

(CND) Certified Network Defender Practice Test

(CND) Certified Network Defender Practice Test

CND CND Network Forensics & Log Analysis 2