EnCE Network Forensics 4

Question 1

During a network forensic investigation, an examiner notices beaconing behavior in firewall logs — periodic outbound connections to the same external IP at regular intervals. This is most consistent with which threat?

Accepted Answer

Malware maintaining a command-and-control (C2) channel

Answer

Regular, periodic beaconing to an external IP is a hallmark of C2 malware checking in with its controller on a set schedule.

Question 2

What is the significance of the 'SYN' flag in a TCP three-way handshake during network forensic analysis?

Accepted Answer

It initiates a new TCP connection from the client to the server

Answer

The TCP SYN flag is set in the first packet of the three-way handshake, indicating that a client is requesting to establish a new connection with a server.

Question 3

An examiner recovers a PCAP containing HTTP POST requests to an external server with Base64-encoded data in the body. What should the examiner consider first?

Accepted Answer

Decode the Base64 content to determine if sensitive data was exfiltrated

Answer

Base64-encoded POST data may represent exfiltrated files or credentials; decoding and analyzing the content is essential to determine what data was transmitted.

Question 4

Which protocol is used to dynamically assign IP addresses to hosts on a network, and what forensic value do its logs hold?

Accepted Answer

DHCP; they map IP addresses to MAC addresses and hostnames over time

Answer

DHCP logs record lease assignments, linking IP addresses to specific MAC addresses and hostnames, which is critical for attributing network activity to a specific device.

Question 5

What is 'SSL stripping' and why is it relevant in network forensic investigations?

Accepted Answer

A man-in-the-middle attack that downgrades HTTPS connections to HTTP, exposing plaintext traffic

Answer

SSL stripping is an attack where an MITM intercepts HTTPS traffic and serves it to the victim over HTTP, allowing the attacker to capture credentials or data in plaintext.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Network Forensics 4