CHFI Network Forensics Investigation Quiz

1. What does DNS exfiltration involve in network forensics?

Using DNS queries to covertly extract data from a network

Blocking all DNS traffic

Accelerating DNS resolution

Creating DNS backup servers

2. What is the primary purpose of creating a forensic image of network logs and configurations?

To improve network performance

To preserve evidence in its original state for admissibility in court

To reduce storage requirements

To accelerate network traffic

3. Which network protocol is responsible for translating domain names to IP addresses and is frequently analyzed in forensic investigations?

DHCP

DNS

SNMP

SMTP

4. In CHFI investigations, what does the term 'indicator of compromise' (IOC) refer to?

Network devices that need replacement

Artifacts that suggest a system has been compromised

Approved security policies

Successful backup completion

5. What is the primary advantage of using network segmentation in forensic investigations?

It eliminates the need for evidence collection

It isolates compromised systems to prevent lateral movement

It automatically removes malware

It increases network speed

6. Which of the following is essential when documenting network forensics evidence?

Only recording successful findings

Detailed timestamps, source/destination IPs, and protocols

Excluding technical details for clarity

Deleting redundant traffic captures

7. In network forensics, what does a port scan typically indicate?

Normal user browsing activity

Potential reconnaissance by an attacker

Successful data exfiltration

Network maintenance operations

8. What is the primary limitation of relying solely on server logs in network forensics investigations?

They are always encrypted and unreadable

Attackers can manipulate or delete logs to cover their tracks

They only record successful connections

They consume too much storage space

9. Which protocol is primarily used for secure remote administration and is often a target in network investigations?

HTTP

FTP

SSH

Telnet

10. In network forensics, what is the primary purpose of analyzing PCAP files?

To verify network device hardware specifications

To examine captured network packets and identify suspicious traffic

To increase network bandwidth

To configure firewall rules

11. What is the primary purpose of network forensics in a digital investigation?

To identify and preserve network traffic evidence for analysis

To physically inspect network hardware

To repair damaged network devices

To optimize network performance

12. Which tool is commonly used to capture network packets in real-time for forensic analysis?

Tcpdump or Wireshark

Nslookup

Ping

Tracert

13. In CHFI investigations, what is the significance of NetFlow data?

It provides detailed packet-level payload analysis

It summarizes network traffic flows for pattern detection

It encrypts all network communications

It physically isolates network segments

14. What does ARP spoofing primarily target in network attacks?

DNS resolution

Layer 2 MAC address resolution

Encryption protocols

Firewall rules

15. Which of the following is a common network forensics artifact that indicates suspicious activity?

Normal DNS queries to legitimate domains

Unusual outbound connections to unknown IPs

Standard HTTP traffic on port 80

Regular DHCP lease renewals

16. What is the Chain of Custody primarily used for in digital forensics?

To document and maintain the integrity of evidence

To speed up the investigation process

To eliminate the need for backups

To automatically identify suspects

17. Which protocol operates at Layer 3 of the OSI model and is responsible for routing?

TCP

IP

Ethernet

HTTP

18. In network forensics, what is the primary advantage of using packet sniffing tools?

They can repair corrupted network packets

They capture and analyze real-time network traffic

They encrypt sensitive network data

They automatically block malicious traffic

19. What does the TCP/IP model layer 4 primarily handle?

Physical transmission of data

Routing and logical addressing

Transport and end-to-end communication

Application-level services

20. Which of the following is a volatile data source that must be captured first during network forensics?

Hard disk contents

RAM and network connections

Backup tapes

Archived logs