EnCE Network Forensics 2 — Questions and Answers
Question 1: Which protocol operates at the transport layer and provides connectionless, unreliable datagram delivery often used in DNS and streaming media?
- TCP
- UDP (Correct answer)
- ICMP
- ARP
Correct answer: UDP
UDP (User Datagram Protocol) is connectionless and does not guarantee delivery, making it suitable for DNS queries and real-time media streaming.
Question 2: In network forensics, what does the term 'packet carving' refer to?
- Physically extracting network cables from a crime scene
- Reconstructing files or data streams from raw packet captures (Correct answer)
- Deleting irrelevant packets from a PCAP file
- Encrypting captured packets for secure storage
Correct answer: Reconstructing files or data streams from raw packet captures
Packet carving is the process of reconstructing files, sessions, or data streams from raw packet capture (PCAP) data.
Question 3: Which EnCase feature allows an examiner to analyze network traffic captures directly within the tool?
- EnCase Endpoint Investigator
- EnCase Network Miner
- EnCase Evidence Processor with PCAP support (Correct answer)
- EnCase Packet Analyzer
Correct answer: EnCase Evidence Processor with PCAP support
EnCase Evidence Processor can ingest and analyze PCAP files, allowing examiners to process network captures as part of a case.
Question 4: What type of attack involves an adversary sending forged ARP replies to associate their MAC address with a legitimate IP address on a network?
- DNS poisoning
- ARP spoofing (Correct answer)
- VLAN hopping
- SYN flooding
Correct answer: ARP spoofing
ARP spoofing (ARP poisoning) allows an attacker to intercept, modify, or stop data in transit by corrupting ARP cache entries on target hosts.
Question 5: An investigator finds NetFlow records from a suspected exfiltration event. What key information do NetFlow records provide that full PCAP does NOT always include?
- Payload content of each session
- Application-layer protocol data
- Aggregate traffic statistics including byte counts and flow duration (Correct answer)
- Decrypted TLS session keys
Correct answer: Aggregate traffic statistics including byte counts and flow duration
NetFlow records provide metadata such as source/destination IPs, ports, byte counts, packet counts, and flow duration without capturing actual payload content.
Question 6: Which layer of the OSI model does the IP protocol operate at?
- Layer 2 - Data Link
- Layer 3 - Network (Correct answer)
- Layer 4 - Transport
- Layer 5 - Session
Correct answer: Layer 3 - Network
IP (Internet Protocol) operates at Layer 3 (Network layer) and is responsible for logical addressing and routing of packets.
Question 7: When reconstructing a TCP session from a PCAP, what information is used to reassemble packets in the correct order?
- IP TTL values
- TCP sequence numbers (Correct answer)
- Ethernet frame checksums
- IP identification fields
Correct answer: TCP sequence numbers
TCP sequence numbers are used to track the order of bytes in a stream, enabling correct reassembly of out-of-order or fragmented TCP segments.
EnCE Network Forensics 2
Which protocol operates at the transport layer and provides connectionless, unreliable datagram delivery often used in DNS and streaming media?