CHFI Network and Cloud Forensics — Timed 10 Questions

Question 1

An investigator needs to capture network traffic from a live network segment without altering the traffic flow. Which technique should they use?

Accepted Answer

Configure a SPAN port on the switch. A SPAN (Switched Port Analyzer) port, also known as a mirror port, copies all traffic from a specified source port or VLAN to a destination port where the forensic workstation is connected. This allows the investigator to capture traffic without injecting any frames or altering the forwarding behavior of the switch, thus preserving the integrity of the live network segment.

Answer

Enable NetFlow on the router and capture flows

Answer

Deploy an ARP spoofing tool to redirect traffic

Answer

Set the NIC to promiscuous mode on the forensic workstation

Question 2

During a cloud forensics investigation, the investigator discovers that the cloud provider uses shared storage for multiple tenants. Which challenge is MOST likely to arise when acquiring a forensic image?

Accepted Answer

Data commingling with other tenants. In cloud environments with shared storage, data from multiple tenants resides on the same physical or logical volume. When acquiring a forensic image, the investigator cannot isolate a single tenant's data without also capturing other tenants' data, leading to data commingling. This violates chain-of-custody and privacy principles, making it the primary challenge.

Answer

Physical acquisition of the storage device is required

Answer

No API access to the storage system

Answer

Inability to decrypt data at rest

Question 3

A forensic analyst is investigating a network breach and finds that the attacker used a technique that bypasses Network Access Control (NAC). Which of the following methods is commonly used to evade 802.1X authentication?

Accepted Answer

MAC address spoofing. MAC address spoofing is commonly used to bypass 802.1X authentication because 802.1X typically authenticates devices based on their MAC address after the EAP (Extensible Authentication Protocol) handshake. By spoofing the MAC address of an already-authenticated device, the attacker can impersonate that device and gain network access without valid credentials, effectively bypassing the NAC enforcement.

Answer

VLAN hopping using double tagging

Answer

DNS tunneling to exfiltrate data

Answer

ARP poisoning to redirect traffic

Question 4

A security team needs to preserve network evidence for a potential legal case. What is the BEST practice for capturing volatile network data?

Accepted Answer

Perform packet capture using a portable tool and store the capture with a cryptographic hash. Option C is correct because capturing volatile network data requires immediate acquisition of live traffic before it is lost, and using a portable tool (e.g., tcpdump, Wireshark) allows rapid deployment. Storing the capture with a cryptographic hash (e.g., SHA-256) ensures data integrity and chain of custody, which is essential for admissibility in legal proceedings. This approach preserves the most volatile evidence (packet contents) while providing verifiable proof that the data has not been altered.

Answer

Wait until normal business hours to capture traffic

Answer

Only record summary logs from the firewall

Answer

Use a dedicated forensic workstation with a write blocker

Question 5

In a cloud forensic investigation, the analyst needs to obtain a memory dump of a virtual machine. Which method is considered forensically sound?

Accepted Answer

Take a snapshot of the VM via the hypervisor and export the .vmem file. Option D is forensically sound because taking a snapshot of the VM via the hypervisor and exporting the .vmem file captures the entire volatile memory state from outside the guest OS, without altering any data inside the VM. This method preserves the memory in its pristine state and avoids the contamination that occurs when executing tools inside the suspect VM.

Answer

Log into the VM and use a tool to create a crash dump

Answer

Copy the virtual disk file (.vmdk) and extract memory from it

Answer

Use a live forensic tool inside the VM to capture memory

Question 6

An organization uses a cloud-based SIEM to collect logs from multiple sources. The investigator notices gaps in the log data for a critical system during the incident timeframe. What is the MOST likely cause?

Accepted Answer

Time drift between the system and the SIEM. Time drift between the system and the SIEM causes logs to be timestamped incorrectly, leading to apparent gaps when the SIEM queries by time range. Even if logs are delivered, they may fall outside the incident timeframe in the SIEM's index, creating the illusion of missing data. This is a common issue in cloud-based SIEMs where NTP synchronization is not enforced across all sources.

Answer

Network latency delayed log delivery

Answer

Log rotation policy deleted logs prematurely

Answer

The system's log level was set to ERROR only

Question 7

During a network forensic investigation, the analyst recovers a PCAP file. What type of information can be directly extracted from this file?

Accepted Answer

Files transferred via HTTP. A PCAP file captures raw network packets. HTTP is an application-layer protocol that transmits data (e.g., files, web pages) in cleartext over TCP. By reassembling TCP streams from the captured packets, an analyst can directly extract files transferred via HTTP, as the payload contains the actual file content.

Answer

Operating system version of the source host

Answer

Registry data of the destination host

Answer

Disk partition table of the sending computer

Question 8

An investigator is analyzing cloud storage logs and finds an entry showing that a file was accessed using the root credentials from an IP address in a different geographic region. The organization has strict policies against root usage. What should the investigator do FIRST?

Accepted Answer

Check if the activity correlates with a known vulnerability or authorized task. Option A is correct because the first step in any forensic investigation is to correlate the suspicious activity with known events, such as authorized tasks or vulnerabilities, to avoid false positives. Root access from an unfamiliar IP could be legitimate if tied to a scheduled maintenance window or a known vulnerability exploitation attempt that requires verification. Prematurely changing credentials or contacting law enforcement could destroy evidence or alert an attacker before the scope is understood.

Answer

Contact law enforcement for cybercrime investigation

Answer

Change the password of the root account

Answer

Immediately revoke the root access keys

Question 9

A forensic analyst is examining a network intrusion detection system (NIDS) alert that triggered on a packet with the FIN, PSH, and URG flags set. What type of scan does this indicate?

Accepted Answer

Xmas scan. A is correct because an Xmas scan sends packets with the FIN, PSH, and URG flags set (like a Christmas tree lit up). According to RFC 793, a closed port must respond with an RST packet, while an open port should drop the packet silently (no response). The NIDS alert triggered on these three flags together, which is the signature of an Xmas scan.

Answer

NULL scan

Answer

SYN scan

Answer

ACK scan

Question 10

Which TWO of the following are common challenges in cloud forensics?

Accepted Answer

Jurisdictional and legal issues due to data stored in multiple regions. Option A is correct because cloud forensic investigations often involve data stored across multiple geographic regions, each with its own data protection laws (e.g., GDPR, CLOUD Act). This creates jurisdictional conflicts regarding lawful access, data privacy, and chain of custody, which are not present in traditional on-premises forensics.

Answer

All cloud environments provide the same forensic capabilities

Answer

Easier evidence acquisition compared to traditional forensics

Answer

Physical access to the hard drive is always available