EnCE Network Forensics 2

Question 1

Which protocol operates at the transport layer and provides connectionless, unreliable datagram delivery often used in DNS and streaming media?

Accepted Answer

UDP

Answer

UDP (User Datagram Protocol) is connectionless and does not guarantee delivery, making it suitable for DNS queries and real-time media streaming.

Question 2

In network forensics, what does the term 'packet carving' refer to?

Accepted Answer

Reconstructing files or data streams from raw packet captures

Answer

Packet carving is the process of reconstructing files, sessions, or data streams from raw packet capture (PCAP) data.

Question 3

Which EnCase feature allows an examiner to analyze network traffic captures directly within the tool?

Accepted Answer

EnCase Evidence Processor with PCAP support

Answer

EnCase Evidence Processor can ingest and analyze PCAP files, allowing examiners to process network captures as part of a case.

Question 4

What type of attack involves an adversary sending forged ARP replies to associate their MAC address with a legitimate IP address on a network?

Accepted Answer

ARP spoofing

Answer

ARP spoofing (ARP poisoning) allows an attacker to intercept, modify, or stop data in transit by corrupting ARP cache entries on target hosts.

Question 5

An investigator finds NetFlow records from a suspected exfiltration event. What key information do NetFlow records provide that full PCAP does NOT always include?

Accepted Answer

Aggregate traffic statistics including byte counts and flow duration

Answer

NetFlow records provide metadata such as source/destination IPs, ports, byte counts, packet counts, and flow duration without capturing actual payload content.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Network Forensics 2