EnCE Network Forensics 4 — Questions and Answers
Question 1: During a network forensic investigation, an examiner notices beaconing behavior in firewall logs — periodic outbound connections to the same external IP at regular intervals. This is most consistent with which threat?
- A scheduled software update process only
- Malware maintaining a command-and-control (C2) channel (Correct answer)
- A misconfigured NTP server
- Normal web browsing patterns
Correct answer: Malware maintaining a command-and-control (C2) channel
Regular, periodic beaconing to an external IP is a hallmark of C2 malware checking in with its controller on a set schedule.
Question 2: What is the significance of the 'SYN' flag in a TCP three-way handshake during network forensic analysis?
- It acknowledges receipt of data from the remote host
- It initiates a new TCP connection from the client to the server (Correct answer)
- It signals the end of a TCP data transfer
- It resets an existing faulty connection
Correct answer: It initiates a new TCP connection from the client to the server
The TCP SYN flag is set in the first packet of the three-way handshake, indicating that a client is requesting to establish a new connection with a server.
Question 3: An examiner recovers a PCAP containing HTTP POST requests to an external server with Base64-encoded data in the body. What should the examiner consider first?
- Ignore the traffic because Base64 is a standard encoding
- Decode the Base64 content to determine if sensitive data was exfiltrated (Correct answer)
- Delete the file because it is corrupted
- Report the IP as a legitimate CDN endpoint without further analysis
Correct answer: Decode the Base64 content to determine if sensitive data was exfiltrated
Base64-encoded POST data may represent exfiltrated files or credentials; decoding and analyzing the content is essential to determine what data was transmitted.
Question 4: Which protocol is used to dynamically assign IP addresses to hosts on a network, and what forensic value do its logs hold?
- DNS; they reveal domain resolution history
- DHCP; they map IP addresses to MAC addresses and hostnames over time (Correct answer)
- SNMP; they provide device configuration data
- BGP; they reveal routing table changes
Correct answer: DHCP; they map IP addresses to MAC addresses and hostnames over time
DHCP logs record lease assignments, linking IP addresses to specific MAC addresses and hostnames, which is critical for attributing network activity to a specific device.
Question 5: What is 'SSL stripping' and why is it relevant in network forensic investigations?
- Removing expired SSL certificates from a web server
- A man-in-the-middle attack that downgrades HTTPS connections to HTTP, exposing plaintext traffic (Correct answer)
- Decrypting stored SSL session keys from memory
- Removing SSL headers from exported PCAP files
Correct answer: A man-in-the-middle attack that downgrades HTTPS connections to HTTP, exposing plaintext traffic
SSL stripping is an attack where an MITM intercepts HTTPS traffic and serves it to the victim over HTTP, allowing the attacker to capture credentials or data in plaintext.
Question 6: In EnCase, which artifact would most directly help an examiner determine which external IPs a suspect system communicated with recently?
- Browser cookie files
- Windows firewall logs and network connection artifacts (Correct answer)
- Recycle Bin metadata
- Font cache files
Correct answer: Windows firewall logs and network connection artifacts
Windows firewall logs and network connection artifacts (such as those in event logs or prefetch files) record IP connections made to and from the system.
Question 7: What does 'lateral movement' mean in the context of network forensics, and which log source best captures it?
- An attacker moving physical servers between data centers; best captured by surveillance footage
- An attacker moving from one compromised host to others within the network; best captured by authentication and SMB/RDP logs (Correct answer)
- Legitimate traffic between load-balanced servers; not forensically relevant
- DNS traffic moving between resolvers; best captured by DNS logs
Correct answer: An attacker moving from one compromised host to others within the network; best captured by authentication and SMB/RDP logs
Lateral movement describes an attacker spreading through the internal network after initial compromise; authentication logs and SMB/RDP session logs are the primary indicators.
EnCE Network Forensics 4
During a network forensic investigation, an examiner notices beaconing behavior in firewall logs — periodic outbound connections to the same external IP at regular intervals.
This is most consistent with which threat?