EnCE Network Forensics 5

Question 1

A forensic examiner captures traffic and notices repeated DNS queries for randomly generated domain names (e.g., xkj29mq.evil.com). This pattern is most indicative of which technique?

Accepted Answer

Domain Generation Algorithm (DGA) used by malware for C2

Answer

Domain Generation Algorithms (DGAs) are used by malware to generate large numbers of pseudo-random domain names, making C2 infrastructure harder to block.

Question 2

When analyzing a PCAP in EnCase, what is the purpose of following a TCP stream?

Accepted Answer

To reconstruct and view the complete data exchanged in a single TCP session

Answer

Following a TCP stream reassembles all packets belonging to a single session, presenting the full application-layer conversation in a readable format.

Question 3

Which network forensic artifact can confirm whether a remote desktop (RDP) session occurred between two systems on a Windows network?

Accepted Answer

Windows Event Log ID 4648 and RDP-related event IDs (1102, 21, 24)

Answer

Windows Event IDs such as 4648 (explicit credential logon) and RDP-specific IDs (e.g., 21=session logon, 24=session disconnect) are key indicators of RDP activity.

Question 4

What is the forensic significance of a 'rogue DHCP server' on a network?

Accepted Answer

It can assign malicious DNS servers or default gateways, enabling MITM attacks and traffic interception

Answer

A rogue DHCP server can redirect victim traffic by providing malicious gateway or DNS settings, facilitating man-in-the-middle attacks and credential theft.

Question 5

In network forensics, what does 'time-to-live' (TTL) manipulation in DNS responses potentially indicate?

Accepted Answer

Fast-flux DNS infrastructure used to rapidly rotate C2 IP addresses and evade blocklisting

Answer

Fast-flux DNS uses very short TTL values (seconds) combined with constantly rotating IP addresses to make C2 servers difficult to block or take down.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Network Forensics 5