EnCE Network Forensics 3 — Questions and Answers
Question 1: What is the primary purpose of a SIEM system in network forensic investigations?
- To encrypt all network traffic for secure storage
- To aggregate and correlate log data from multiple sources for threat detection (Correct answer)
- To perform deep packet inspection on all traffic in real time
- To automatically patch vulnerabilities discovered during investigations
Correct answer: To aggregate and correlate log data from multiple sources for threat detection
A SIEM (Security Information and Event Management) system collects, aggregates, and correlates logs and events from across an environment to identify security incidents.
Question 2: In a network forensic investigation, which DNS record type would an examiner focus on to identify hosts that may be used for C2 via domain fronting?
- MX records
- CNAME records (Correct answer)
- SOA records
- PTR records
Correct answer: CNAME records
CNAME records are commonly abused in domain fronting attacks because they allow traffic destined for a benign CDN host to be routed to a malicious backend.
Question 3: Which port is used by default for HTTPS traffic?
- 80
- 8080
- 443 (Correct answer)
- 8443
Correct answer: 443
HTTPS (HTTP over TLS/SSL) uses TCP port 443 by default for encrypted web communications.
Question 4: An investigator observes large volumes of ICMP echo requests from a single internal host to external IPs. What malicious activity might this indicate?
- SQL injection attack
- ICMP tunneling or data exfiltration (Correct answer)
- Man-in-the-middle attack
- ARP poisoning campaign
Correct answer: ICMP tunneling or data exfiltration
ICMP tunneling can be used to exfiltrate data or establish covert C2 channels by embedding data within ICMP echo request/reply packets.
Question 5: What does the TTL field in an IP header indicate, and why is it forensically relevant?
- The total time a packet spent in transit; irrelevant to forensics
- The number of hops remaining before a packet is discarded; can help estimate source distance (Correct answer)
- The encryption algorithm used for the packet payload
- The time the packet was captured relative to UTC
Correct answer: The number of hops remaining before a packet is discarded; can help estimate source distance
The IP TTL (Time to Live) decrements at each router hop; its starting value can help estimate how many hops away the source is, which aids in tracing packet origins.
Question 6: Which type of log is most useful for reconstructing user web browsing activity during a network investigation when full PCAP is unavailable?
- DHCP server logs
- DNS query logs (Correct answer)
- SNMP trap logs
- NTP synchronization logs
Correct answer: DNS query logs
DNS query logs record the domain names resolved by hosts, providing a timeline of sites visited even when full packet captures are not available.
Question 7: In Wireshark or EnCase, what does a TCP RST flag indicate in a captured session?
- The session is being gracefully terminated by mutual agreement
- One side is abruptly resetting and tearing down the connection (Correct answer)
- A new TCP connection is being initiated
- The packet contains urgent data that must be prioritized
Correct answer: One side is abruptly resetting and tearing down the connection
A TCP RST (reset) flag causes an immediate, non-graceful termination of the connection, often indicating a refused connection or forced teardown.
EnCE Network Forensics 3
What is the primary purpose of a SIEM system in network forensic investigations?