EnCE Network Forensics 3

Question 1

What is the primary purpose of a SIEM system in network forensic investigations?

Accepted Answer

To aggregate and correlate log data from multiple sources for threat detection

Answer

A SIEM (Security Information and Event Management) system collects, aggregates, and correlates logs and events from across an environment to identify security incidents.

Question 2

In a network forensic investigation, which DNS record type would an examiner focus on to identify hosts that may be used for C2 via domain fronting?

Accepted Answer

CNAME records

Answer

CNAME records are commonly abused in domain fronting attacks because they allow traffic destined for a benign CDN host to be routed to a malicious backend.

Question 3

Which port is used by default for HTTPS traffic?

Accepted Answer

443

Answer

HTTPS (HTTP over TLS/SSL) uses TCP port 443 by default for encrypted web communications.

Question 4

An investigator observes large volumes of ICMP echo requests from a single internal host to external IPs. What malicious activity might this indicate?

Accepted Answer

ICMP tunneling or data exfiltration

Answer

ICMP tunneling can be used to exfiltrate data or establish covert C2 channels by embedding data within ICMP echo request/reply packets.

Question 5

What does the TTL field in an IP header indicate, and why is it forensically relevant?

Accepted Answer

The number of hops remaining before a packet is discarded; can help estimate source distance

Answer

The IP TTL (Time to Live) decrements at each router hop; its starting value can help estimate how many hops away the source is, which aids in tracing packet origins.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Network Forensics 3