CHFI OS and Network Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Block the external IP at the firewall

  Why it's wrong here

  Blocking the external IP at the firewall is a reactive containment step that may stop the immediate scanning, but it does not remediate any compromise that has already occurred. Evasion techniques such as IP spoofing, distributed source addresses, or anonymization proxies (e.g., Tor exit nodes) can bypass such a block, and the analyst loses visibility into follow-up activity. The correct first step is to determine whether the repeated connections indicate successful exploitation or merely reconnaissance.

• ✗

  Ignore the traffic as it is encrypted

  Why it's wrong here

  Encrypted traffic cannot be treated as benign simply because its payload is opaque; modern malware and command-and-control (C2) channels routinely use TLS/HTTPS to conceal exfiltration and remote commands. Even without decryption, metadata such as connection frequency, payload size, destination reputation, and the server's internal logs can reveal malicious behavior. Ignoring the traffic would violate the fundamental security principle of verifying suspicious activity rather than dismissing it due to encryption.

• ✗

  Disable the server's network connection

  Why it's wrong here

  Disconnecting the server from the network may be necessary in a confirmed active breach to prevent lateral movement, but doing so prematurely can destroy volatile evidence (e.g., memory contents, live processes, active network connections) and disrupt legitimate business services. It should be a deliberated decision made after preserving forensic data and after confirming that the server is indeed compromised. Without prior investigation, this action is both disruptive and potentially premature.

• ✓

  Investigate the server for signs of compromise

  Why this is correct

  Investigating the server for signs of compromise is the appropriate first response to repeated connections, as it determines whether the external IP's activity has successfully exploited a vulnerability. This includes checking for unauthorized processes, anomalous registry entries, new user accounts, scheduled tasks, modified binaries, and indicators of compromise (IOCs) such as unusual outbound connections or file hashes. Establishing a baseline and correlating firewall logs with endpoint logs enables the analyst to identify the attack vector, scope, and appropriate remediation steps.

Go deeper

Related to this question