CND CND Network Forensics & Log Analysis 1 — Questions and Answers
Question 1: Which log type is most useful for reconstructing a timeline of network intrusion events?
- Application event logs
- Network flow (NetFlow/IPFIX) logs (Correct answer)
- Print spooler logs
- Font cache logs
Correct answer: Network flow (NetFlow/IPFIX) logs
Network flow logs capture source/destination IP, ports, timestamps, and byte counts, making them ideal for reconstructing intrusion timelines.
Question 2: What is the primary purpose of a Security Information and Event Management (SIEM) system in network forensics?
- Encrypt network traffic
- Correlate and aggregate log data for real-time analysis (Correct answer)
- Replace firewall rules
- Generate SSL certificates
Correct answer: Correlate and aggregate log data for real-time analysis
A SIEM centralizes log collection from multiple sources and applies correlation rules to detect suspicious patterns in real time.
Question 3: Which tool is commonly used for capturing and analyzing raw network packets during forensic investigation?
- Wireshark (Correct answer)
- Nessus
- Metasploit
- Aircrack-ng
Correct answer: Wireshark
Wireshark is the industry-standard open-source packet analyzer used to capture and inspect raw network traffic during forensic investigations.
Question 4: What does the term 'chain of custody' mean in the context of network forensics?
- The sequence of firewall rules applied to traffic
- Documented handling of evidence from collection to court presentation (Correct answer)
- The order in which logs are rotated
- A VPN tunnel encryption sequence
Correct answer: Documented handling of evidence from collection to court presentation
Chain of custody documents every person who handled digital evidence and every action taken, ensuring admissibility in legal proceedings.
Question 5: When analyzing logs, what is a 'false positive' in the context of an IDS alert?
- A real attack that was missed
- A legitimate activity incorrectly flagged as malicious (Correct answer)
- A duplicate log entry
- An encrypted packet the IDS cannot read
Correct answer: A legitimate activity incorrectly flagged as malicious
A false positive occurs when an IDS triggers an alert on benign traffic that matches a malicious signature pattern.
Question 6: Which Windows event log ID is associated with a successful user logon?
- 4624 (Correct answer)
- 4625
- 4648
- 4720
Correct answer: 4624
Windows Event ID 4624 is generated each time a user successfully logs on to the system.
CND CND Network Forensics & Log Analysis 1
Which log type is most useful for reconstructing a timeline of network intrusion events?