CHFI - Computer Hacking Forensic Investigator Network Forensics Questions and Answers — Questions and Answers
Question 1: A network forensic analyst is examining a packet capture (.pcap) file and observes a three-way handshake followed by an encrypted exchange between a client and a server. Suddenly, the analyst sees a large number of TCP packets with the RST (Reset) flag set being sent from the server to the client. What does this pattern most likely indicate?
- A successful file transfer was completed using FTP.
- A Distributed Denial of Service (DDoS) attack using a TCP SYN flood.
- An abrupt termination of the TCP connection, possibly by a firewall or Intrusion Prevention System (IPS). (Correct answer)
- A normal termination of the connection using the FIN flag.
Correct answer: An abrupt termination of the TCP connection, possibly by a firewall or Intrusion Prevention System (IPS).
A TCP RST (Reset) flag is used to immediately terminate a connection. While it can occur for normal reasons like an application crash, a sudden flood of RST packets after a valid connection has been established is often indicative of an external system, like a firewall or an IPS, forcibly closing the session because it detected suspicious or malicious traffic. A normal termination uses the FIN flag, and a SYN flood would consist of many SYN packets without a completed handshake.
Question 2: When investigating a network security incident, a forensic analyst lacks a full packet capture but has access to NetFlow records from the organization's routers. What type of information can the analyst primarily derive from this data?
- The complete content of emails transmitted during the incident.
- Metadata about network conversations, including source/destination IPs, ports, and the volume of data transferred. (Correct answer)
- Specific commands executed by an attacker on a compromised host.
- Cryptographic keys used to encrypt the network traffic.
Correct answer: Metadata about network conversations, including source/destination IPs, ports, and the volume of data transferred.
NetFlow data provides a high-level summary or metadata of network traffic, often compared to a phone bill. It records details like the source and destination IP addresses, source and destination ports, protocol, and the total bytes transferred for a given conversation ('flow'). It does not capture the actual payload or content of the packets, so it cannot reveal email contents, specific commands, or cryptographic keys.
Question 3: An investigator needs to capture live network traffic from a specific interface on a remote Linux server and save it to a file for later analysis. The investigator wants to use a command-line tool that is widely available and efficient. Which of the following tools is most suitable for this task?
- Autopsy
- tcpdump (Correct answer)
- Volatility
- Network Miner
Correct answer: tcpdump
tcpdump is a classic, powerful, and ubiquitous command-line packet capture utility available on Linux and other Unix-like systems. It is ideal for capturing traffic on remote servers where a GUI is not available. Autopsy is a disk forensics suite, Volatility is for memory forensics, and while Network Miner is a network forensic analysis tool, it is primarily a GUI-based application for Windows.
Question 4: During an investigation into a suspected malware infection, a CHFI analyst discovers an unusually high volume of DNS queries for various, seemingly random subdomains of a single parent domain (e.g., `axj34.evil.com`, `b9dk1.evil.com`). The compromised host is not receiving valid IP addresses in response. This pattern is a strong indicator of which activity?
- Data exfiltration or Command and Control (C2) communication using DNS tunneling. (Correct answer)
- A DNS zone transfer attempt to enumerate all hosts in the domain.
- A Distributed Denial of Service (DDoS) attack against the organization's DNS server.
- A DNS amplification attack originating from the compromised host.
Correct answer: Data exfiltration or Command and Control (C2) communication using DNS tunneling.
This pattern is a classic indicator of DNS tunneling, a technique used to bypass firewalls by encoding data into DNS queries. Malware on a compromised host encodes stolen data or C2 communications into the subdomain portion of a DNS query, which is then sent to a malicious DNS server controlled by the attacker. The high volume of queries with long, randomized subdomains is a key giveaway.
Question 5: A forensic investigator is analyzing a wireless packet capture and identifies a large number of deauthentication frames being broadcast. These frames appear to originate from the legitimate Access Point's MAC address but are targeting all connected clients, causing widespread disconnections. What is this specific type of attack called?
- Evil Twin Attack
- ARP Spoofing
- MAC Flooding
- Wi-Fi Disassociation/Deauthentication Attack (Correct answer)
Correct answer: Wi-Fi Disassociation/Deauthentication Attack
This scenario describes a Wi-Fi Disassociation or Deauthentication attack. In this attack, an adversary sends forged deauthentication or disassociation frames to clients, spoofing the MAC address of the Access Point. This tricks the clients into disconnecting from the network, causing a denial-of-service condition.
Question 6: Which of the following network log sources would be most valuable for an investigator trying to correlate an internal private IP address with a specific device's unique hardware address (MAC address) at a particular time?
- Firewall logs
- IDS/IPS logs
- DHCP server logs (Correct answer)
- Web proxy logs
Correct answer: DHCP server logs
DHCP (Dynamic Host Configuration Protocol) server logs are the most direct source for this information. The DHCP server is responsible for leasing IP addresses to devices on the network, and its logs record which MAC address requested an IP and which IP address was assigned at a specific time. This allows an investigator to definitively link a temporary IP address to a physical device.
CHFI - Computer Hacking Forensic Investigator Network Forensics Questions and Answers
A network forensic analyst is examining a packet capture (.pcap) file and observes a three-way handshake followed by an encrypted exchange between a client and a server.
Suddenly, the analyst sees a large number of TCP packets with the RST (Reset) flag set being sent from the server to the client.
What does this pattern most likely indicate?