CND CND Network Forensics & Log Analysis

Question 1

Which log type is most useful for reconstructing a timeline of network intrusion events?

Accepted Answer

Network flow (NetFlow/IPFIX) logs

Answer

Network flow logs capture source/destination IP, ports, timestamps, and byte counts, making them ideal for reconstructing intrusion timelines.

Question 2

What is the primary purpose of a Security Information and Event Management (SIEM) system in network forensics?

Accepted Answer

Correlate and aggregate log data for real-time analysis

Answer

A SIEM centralizes log collection from multiple sources and applies correlation rules to detect suspicious patterns in real time.

Question 3

Which tool is commonly used for capturing and analyzing raw network packets during forensic investigation?

Accepted Answer

Wireshark

Answer

Wireshark is the industry-standard open-source packet analyzer used to capture and inspect raw network traffic during forensic investigations.

Question 4

What does the term 'chain of custody' mean in the context of network forensics?

Accepted Answer

Documented handling of evidence from collection to court presentation

Answer

Chain of custody documents every person who handled digital evidence and every action taken, ensuring admissibility in legal proceedings.

Question 5

When analyzing logs, what is a 'false positive' in the context of an IDS alert?

Accepted Answer

A legitimate activity incorrectly flagged as malicious

Answer

A false positive occurs when an IDS triggers an alert on benign traffic that matches a malicious signature pattern.

(CND) Certified Network Defender Practice Test