CHFI Network Forensics 4 — Questions and Answers
Question 1: What does the 'conversation' view in Wireshark primarily help an investigator accomplish?
- Decode encrypted traffic
- Identify all unique bidirectional communication pairs in a capture (Correct answer)
- Filter packets by protocol type
- Reassemble fragmented IP datagrams
Correct answer: Identify all unique bidirectional communication pairs in a capture
Wireshark's Conversations window displays all unique endpoint pairs communicating in the capture, showing statistics like packet counts and bytes exchanged per conversation.
Question 2: During investigation, an analyst finds that a system sent a DHCP request claiming to be a different device's MAC address. This attack is called:
- IP spoofing
- DHCP starvation
- MAC spoofing (Correct answer)
- Rogue DHCP server attack
Correct answer: MAC spoofing
MAC spoofing involves changing the source MAC address in frames to impersonate another device, which can be detected by comparing DHCP requests against switch MAC address tables.
Question 3: Which RFC defines the syslog protocol commonly used to collect network device logs for forensic analysis?
- RFC 791
- RFC 5424 (Correct answer)
- RFC 2616
- RFC 1918
Correct answer: RFC 5424
RFC 5424 defines the current syslog protocol standard, specifying the format for system log messages used by network devices, servers, and security appliances.
Question 4: An investigator wants to determine all websites visited by a user using only proxy server logs. Which log field is most critical for this analysis?
- Client IP address
- Bytes transferred
- Requested URL or CONNECT hostname (Correct answer)
- HTTP response code
Correct answer: Requested URL or CONNECT hostname
The requested URL or CONNECT hostname in proxy logs directly identifies which web resources the client accessed, making it the primary field for website visit reconstruction.
Question 5: What network forensics technique involves correlating traffic across multiple capture points to trace the path of an attacker through the network?
- Packet carving
- Traffic path reconstruction (Correct answer)
- Deep packet inspection
- Protocol decoding
Correct answer: Traffic path reconstruction
Traffic path reconstruction correlates timestamps and connection metadata from multiple network taps or logs to trace how an attacker moved laterally through network segments.
Question 6: A sudden spike in outbound traffic on port 25 from a workstation not running a mail server most likely indicates:
- Normal Windows update activity
- The workstation is part of a spam botnet (Correct answer)
- A legitimate backup operation
- IPv6 router advertisement flooding
Correct answer: The workstation is part of a spam botnet
Workstations unexpectedly generating SMTP traffic on port 25 are typically compromised and enrolled in a botnet being used to send spam email.
Question 7: Which analysis technique examines the timing intervals between network packets to identify covert communication channels even when content is encrypted?
- Signature-based detection
- Traffic timing analysis / inter-arrival time analysis (Correct answer)
- Hash-based file carving
- Banner grabbing
Correct answer: Traffic timing analysis / inter-arrival time analysis
Traffic timing analysis examines inter-packet arrival times to detect patterns that may indicate covert channels where timing itself encodes information, bypassing content-level inspection.
CHFI Network Forensics 4
What does the 'conversation' view in Wireshark primarily help an investigator accomplish?