CDFI CDFI Network Forensics & Traffic Analysis 2 — Questions and Answers
Question 1: Which log source is BEST for correlating multiple network events across an enterprise during a forensic investigation?
- Individual host event logs
- SIEM (Security Information and Event Management) system (Correct answer)
- Router ARP tables
- DHCP lease files
Correct answer: SIEM (Security Information and Event Management) system
A SIEM aggregates and correlates logs from multiple sources enterprise-wide, making it the best tool for building a timeline of network-based incidents.
Question 2: What is 'IP geolocation' used for in network forensics?
- Encrypting captured traffic
- Estimating the physical location of an IP address (Correct answer)
- Assigning static IPs to servers
- Measuring network latency
Correct answer: Estimating the physical location of an IP address
IP geolocation maps an IP address to an approximate geographic location, helping investigators identify the origin of malicious traffic.
Question 3: When investigating a potential data exfiltration event, which traffic characteristic is most suspicious?
- High inbound traffic volume during business hours
- Large outbound transfers to unknown external IPs at night (Correct answer)
- Low-latency DNS responses
- Consistent HTTP GET requests to known CDNs
Correct answer: Large outbound transfers to unknown external IPs at night
Large outbound data transfers to unknown IPs during off-hours is a classic indicator of data exfiltration that warrants deep forensic investigation.
Question 4: Which technique allows a forensic investigator to reassemble fragmented IP packets for analysis?
- ARP spoofing
- Packet defragmentation (Correct answer)
- NAT traversal
- Deep packet inspection filtering
Correct answer: Packet defragmentation
Packet defragmentation reassembles split IP datagrams in the correct order so investigators can examine the complete payload of transmitted data.
Question 5: What does TLS/SSL decryption capability allow a forensic investigator to do during network analysis?
- Block suspicious traffic automatically
- Inspect the plaintext content of encrypted sessions (Correct answer)
- Create digital signatures
- Restore deleted network logs
Correct answer: Inspect the plaintext content of encrypted sessions
With access to private keys or using a MITM proxy, TLS decryption lets investigators read the actual plaintext content of otherwise encrypted communications.
Question 6: In network forensics, what is the significance of a 'golden ticket' attack in Kerberos traffic logs?
- It indicates a successful patch update
- It means an attacker forged a Kerberos TGT for persistent unauthorized access (Correct answer)
- It marks normal load-balancer behavior
- It identifies a DNS misconfiguration
Correct answer: It means an attacker forged a Kerberos TGT for persistent unauthorized access
A golden ticket attack involves forging a Kerberos Ticket Granting Ticket using a stolen KRBTGT hash, granting attackers long-term, stealthy domain access.
CDFI CDFI Network Forensics & Traffic Analysis 2
Which log source is BEST for correlating multiple network events across an enterprise during a forensic investigation?