CHFI Network Forensics 5 — Questions and Answers
Question 1: In the context of wireless network forensics, what does a 'deauthentication flood' attack leave as evidence in wireless packet captures?
- Excessive probe request frames
- High volume of deauthentication frames from a spoofed BSSID (Correct answer)
- Duplicate SSID beacons
- Elevated data frame retransmission rates
Correct answer: High volume of deauthentication frames from a spoofed BSSID
A deauthentication flood generates massive quantities of 802.11 deauth management frames with a spoofed source BSSID, forcing clients offline; these frames are clearly visible in wireless captures.
Question 2: Which network forensics artifact would best help an investigator determine the exact time a specific external IP address first communicated with an internal host?
- Routing table entries
- Firewall log timestamps for the first allowed session (Correct answer)
- ARP cache entries
- SNMP trap logs
Correct answer: Firewall log timestamps for the first allowed session
Firewall logs record timestamped allow/deny decisions for every connection attempt, providing the most reliable record of when external communication with an internal host first occurred.
Question 3: What is 'passive OS fingerprinting' in network forensics?
- Sending probe packets to determine a remote system's OS
- Identifying operating systems by analyzing characteristics of traffic they generate without sending probes (Correct answer)
- Scanning open ports to match known OS signatures
- Examining installed patches on a target system
Correct answer: Identifying operating systems by analyzing characteristics of traffic they generate without sending probes
Passive OS fingerprinting identifies remote operating systems by analyzing observable TCP/IP stack characteristics (TTL values, TCP window sizes, flag combinations) in captured traffic without generating any probe traffic.
Question 4: An analyst captures traffic and notices that HTTP responses contain an unusually large number of Set-Cookie headers with random-looking values. This may indicate:
- A standard e-commerce session management system
- Cookie-based data exfiltration or C2 channel using HTTP (Correct answer)
- Normal CDN cache-control behavior
- HTTP/2 server push functionality
Correct answer: Cookie-based data exfiltration or C2 channel using HTTP
Malware can use HTTP cookies to smuggle data and commands between compromised hosts and C2 servers, with encoded payloads embedded in seemingly legitimate cookie values.
Question 5: Which forensic evidence would confirm that a VPN tunnel was established between two hosts, even if the tunneled content is encrypted?
- HTTP GET requests in cleartext
- Presence of encapsulating protocols such as GRE, ESP, or OpenVPN's UDP traffic on known VPN ports (Correct answer)
- ICMP echo-reply messages
- TCP RST packets between the hosts
Correct answer: Presence of encapsulating protocols such as GRE, ESP, or OpenVPN's UDP traffic on known VPN ports
VPN protocols leave identifiable traces such as ESP (IPsec), GRE encapsulation headers, or UDP traffic on well-known VPN ports (e.g., 1194 for OpenVPN, 500/4500 for IKE) even when payload is encrypted.
Question 6: During investigation of a data breach, an analyst finds large volumes of traffic to a cloud storage IP during off-hours. What forensic step should be taken next?
- Immediately block the destination IP at the firewall
- Correlate the traffic with user authentication logs to identify which account or process initiated the transfers (Correct answer)
- Reimage the potentially affected systems
- Submit the IP to a threat intelligence feed
Correct answer: Correlate the traffic with user authentication logs to identify which account or process initiated the transfers
Correlating suspicious network traffic with authentication and process logs identifies the specific user account or process responsible for the transfers, establishing attribution before taking remediation steps.
Question 7: What is the purpose of analyzing 'flow records' with a tool like nfdump in a network forensics investigation?
- Decrypting captured TLS sessions
- Querying and filtering large volumes of NetFlow data to identify anomalous traffic patterns (Correct answer)
- Reconstructing application-layer sessions from raw packets
- Mapping physical network device connectivity
Correct answer: Querying and filtering large volumes of NetFlow data to identify anomalous traffic patterns
nfdump is a command-line tool for reading, filtering, and aggregating NetFlow records stored by nfcapd, enabling investigators to query large traffic datasets for anomalous flows without processing full packet captures.
CHFI Network Forensics 5
In the context of wireless network forensics, what does a 'deauthentication flood' attack leave as evidence in wireless packet captures?