Network Forensics Quiz: Can You Trace The Attack?

1. What is the primary forensic value of examining DHCP logs?

To identify which IP addresses were assigned to specific MAC addresses

To decrypt wireless networks

To bypass firewall rules

To modify packet headers

2. Which forensic artifact on a Windows system records the most recent files opened by a user?

Event Viewer logs

Recent Documents folder and Registry ShellBags

Temporary Internet Files

System32 directory

3. In packet analysis, what does the TTL (Time To Live) field help investigators identify?

The encryption algorithm used

The approximate number of hops a packet traveled

The source user's identity

The file type being transmitted

4. What does the acronym SIEM stand for in the context of network forensics and security monitoring?

Secure Internet Exchange Module

Security Information and Event Management

System Integrity Evaluation Method

Suspicious IP Examination Monitor

5. Which protocol is primarily used for secure remote administration and would be relevant in forensic examination of administrative activities?

Telnet

SSH

HTTP

FTP

6. In network forensics, what does the term 'carving' refer to?

Removing network packets from a pcap file

Extracting data fragments from unallocated space or memory

Encrypting network traffic

Modifying log file timestamps

7. What is the forensic significance of examining the Windows Prefetch folder?

It stores deleted files

It records program execution history with timestamps

It contains encrypted passwords

It tracks network connections only

8. Which command-line tool on Linux systems can display all active network connections and listening ports?

Ifconfig

Netstat or ss

Ping

Traceroute

9. In network forensics, what does a SYN flood attack attempt to exploit?

The TCP three-way handshake mechanism

DNS resolution vulnerabilities

ARP protocol weaknesses

ICMP echo requests

10. Which file system artifact contains information about recently accessed files on a Windows system?

Master File Table (MFT)

Journal

USN Journal

Boot sector

11. Which protocol analyzer tool is most commonly used to capture and examine network traffic in real-time during a forensic investigation?

Wireshark

Nessus

Metasploit

Burp Suite

12. When analyzing a pcap file, which OSI layer does TCP operate at?

Layer 2 (Data Link)

Layer 3 (Network)

Layer 4 (Transport)

Layer 7 (Application)

13. Which HTTP status code indicates a successful request in web server logs?

400

404

200

500

14. What does ARP spoofing enable an attacker to do in a network environment?

Intercept traffic between two hosts on the same network

Encrypt all network packets

Bypass password authentication

Access the internet without an IP address

15. Which artifact in the Windows Registry stores recently accessed network shares?

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs

16. In network forensics, what is the primary value of examining NetFlow data?

To decrypt encrypted traffic

To summarize traffic patterns and identify anomalies

To bypass firewalls

To crack passwords

17. Which tool is best suited for analyzing DNS queries and responses to identify malicious domain lookups?

Tcpdump

Zeek (formerly Bro)

Hashcat

John the Ripper

18. What does a TCP three-way handshake reveal in network forensics?

The encryption method used

Connection initiation between client and server

The payload of the data transferred

The user credentials

19. Which log file typically records all inbound and outbound network connections on a Windows system?

Application.evt

Security.evt

System.evt

Firewall.log

20. What is the primary purpose of maintaining a chain of custody during network forensics?

To speed up the investigation process

To ensure evidence integrity and admissibility in court

To reduce investigation costs

To identify the suspect immediately

Network Forensics Quiz: Can You Trace the Attack?