EnCE Network Forensics 5 — Questions and Answers
Question 1: A forensic examiner captures traffic and notices repeated DNS queries for randomly generated domain names (e.g., xkj29mq.evil.com). This pattern is most indicative of which technique?
- DNSSEC validation failures
- Domain Generation Algorithm (DGA) used by malware for C2 (Correct answer)
- Legitimate CDN load balancing
- IPv6 transition mechanism
Correct answer: Domain Generation Algorithm (DGA) used by malware for C2
Domain Generation Algorithms (DGAs) are used by malware to generate large numbers of pseudo-random domain names, making C2 infrastructure harder to block.
Question 2: When analyzing a PCAP in EnCase, what is the purpose of following a TCP stream?
- To redirect the TCP session to a different network interface
- To reconstruct and view the complete data exchanged in a single TCP session (Correct answer)
- To inject additional packets into an ongoing session
- To delete incomplete TCP sessions from the capture file
Correct answer: To reconstruct and view the complete data exchanged in a single TCP session
Following a TCP stream reassembles all packets belonging to a single session, presenting the full application-layer conversation in a readable format.
Question 3: Which network forensic artifact can confirm whether a remote desktop (RDP) session occurred between two systems on a Windows network?
- Browser history files on the client
- Windows Event Log ID 4648 and RDP-related event IDs (1102, 21, 24) (Correct answer)
- Recycle Bin entries on the server
- Font installation logs
Correct answer: Windows Event Log ID 4648 and RDP-related event IDs (1102, 21, 24)
Windows Event IDs such as 4648 (explicit credential logon) and RDP-specific IDs (e.g., 21=session logon, 24=session disconnect) are key indicators of RDP activity.
Question 4: What is the forensic significance of a 'rogue DHCP server' on a network?
- It speeds up IP address assignment for legitimate users
- It can assign malicious DNS servers or default gateways, enabling MITM attacks and traffic interception (Correct answer)
- It prevents IP address conflicts on the subnet
- It automatically segments the network into VLANs
Correct answer: It can assign malicious DNS servers or default gateways, enabling MITM attacks and traffic interception
A rogue DHCP server can redirect victim traffic by providing malicious gateway or DNS settings, facilitating man-in-the-middle attacks and credential theft.
Question 5: In network forensics, what does 'time-to-live' (TTL) manipulation in DNS responses potentially indicate?
- A misconfigured web server sending incorrect cache headers
- Fast-flux DNS infrastructure used to rapidly rotate C2 IP addresses and evade blocklisting (Correct answer)
- Normal DNS load balancing across multiple servers
- A DNSSEC validation error on the resolver
Correct answer: Fast-flux DNS infrastructure used to rapidly rotate C2 IP addresses and evade blocklisting
Fast-flux DNS uses very short TTL values (seconds) combined with constantly rotating IP addresses to make C2 servers difficult to block or take down.
Question 6: Which tool capability in EnCase allows examiners to search for and recover deleted or partial network artifacts from unallocated disk space on a forensic image?
- EnCase Network Acquisition Wizard
- EnCase keyword search and file carving on unallocated clusters (Correct answer)
- EnCase Live Network Monitor
- EnCase Packet Injector
Correct answer: EnCase keyword search and file carving on unallocated clusters
EnCase's keyword search and carving capabilities can locate remnants of network-related files (e.g., cached DNS entries, browser history, partial PCAP files) in unallocated disk space.
Question 7: An examiner is investigating a data breach and finds encrypted traffic to a cloud storage provider. The TLS handshake is intact but payload is encrypted. What is the BEST next forensic step?
- Discard the traffic as unexaminable
- Examine endpoint artifacts such as browser history, cloud sync logs, and application logs to determine what files were uploaded (Correct answer)
- Attempt to crack the TLS encryption using brute force
- Report the cloud provider's IP as malicious without further investigation
Correct answer: Examine endpoint artifacts such as browser history, cloud sync logs, and application logs to determine what files were uploaded
When network payload is encrypted, pivoting to endpoint artifacts — browser history, cloud application logs, file system activity — can reveal what data was transferred even without decrypting the traffic.
EnCE Network Forensics 5
A forensic examiner captures traffic and notices repeated DNS queries for randomly generated domain names (e.g., xkj29mq.evil.com).
This pattern is most indicative of which technique?