CHFI Network and Cloud Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Wait until normal business hours to capture traffic

  Why it's wrong here

  Network traffic is ephemeral; delaying capture until normal business hours risks losing the very packets that document the incident, such as active sessions, DNS queries, or C2 beaconing that occurred during the suspected compromise window. Volatile evidence requires immediate acquisition because buffers, kernel packet queues, and switch port buffers overwrite continuously. Capturing later may also capture unrelated baseline traffic rather than the malicious activity, contaminating the evidentiary narrative.

• ✗

  Only record summary logs from the firewall

  Why it's wrong here

  Firewall summary logs typically contain connection-level metadata (source/destination IP, ports, timestamps, and byte counts) but discard the packet payloads and application-layer data needed to reconstruct an exploit, extract a malware sample, or prove data exfiltration. Without full packet content, an investigator cannot inspect TCP stream reassembly, HTTP requests, or encrypted payloads that the firewall may only see as opaque sessions. Logs also depend on retention policies and may be incomplete or overwritten before collection.

• ✓

  Perform packet capture using a portable tool and store the capture with a cryptographic hash

  Why this is correct

  Performing packet capture with a portable tool such as tcpdump or dumpcap on a mirror port preserves the live, volatile network state while minimizing footprint, and a cryptographic hash (like SHA-256) computed at acquisition time provides integrity verification for later evidence examination. The captured PCAP stores both headers and payloads, allowing protocol analysis and stream reassembly. Store the capture on write-protected media and record the hash in the chain-of-custody documentation to prove tamper-resistance.

• ✗

  Use a dedicated forensic workstation with a write blocker

  Why it's wrong here

  A write blocker is designed for forensic acquisition of block-based storage media to prevent inadvertent writes during disk imaging; network interfaces are not block devices, and attaching a write blocker to a packet capture setup has no functional effect on capturing frames. Moreover, relying on a fixed forensic workstation may be less portable and could interfere with network tapping. The correct network evidence approach uses a dedicated capture interface in promiscuous mode with hashing afterward, not a storage-imaging write blocker.

Go deeper

Related to this question