I85PREP
⌘ K
CNFE study materials
CNFE study resources

CNFE practice questions

One question at a time. Build your CNFE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Forensics Fundamentals and Legal Considerations

Which principle of digital forensics requires that evidence be preserved in its original form and that any analysis be performed on a verified copy?

  1. The principle of chain of custody delegation
  2. The principle of evidence integrity and non-alteration Correct answer.
  3. The principle of order of volatility
  4. The principle of least privilege

Explanation

Forensic soundness rests on preserving the original evidence and working from a verified duplicate whose hash matches the source. This ensures that findings can be defended as reflecting the untouched original. Order of volatility concerns collection sequence, not preservation of originals.

Question 2Network Forensics Fundamentals and Legal Considerations

During a live network investigation, which data source is generally considered the most volatile and therefore collected first?

  1. Router configuration files stored on flash
  2. Disk images of decommissioned servers
  3. Contents of RAM including active TCP session tables Correct answer.
  4. Log files archived to a remote syslog server

Explanation

Volatile memory such as RAM and active connection state disappears on shutdown or reboot, so it is captured before persistent stores. Router configs, archived logs, and disk images persist and can be collected later without loss. This follows the standard order-of-volatility guidance.

Question 3Network Forensics Fundamentals and Legal Considerations

A packet capture is taken from a span port on a switch. Which statement best describes a limitation the analyst must document?

  1. The span port automatically decrypts all TLS sessions for inspection
  2. The span port records only inbound traffic and never outbound traffic
  3. The span port may drop frames under load and cannot show frames that never traversed the monitored links Correct answer.
  4. The span port guarantees capture of every frame including those dropped by the switch ASIC

Explanation

Port mirroring is best-effort; overloaded span sessions can drop frames and the capture only reflects traffic crossing the mirrored links. Analysts must note these gaps because absence of a packet in the capture is not proof the packet never existed. Span ports do not decrypt TLS or filter by direction by default.

Question 4Network Forensics Fundamentals and Legal Considerations

Which artifact most directly establishes that a seized hard drive has not been altered since acquisition?

  1. A cryptographic hash of the acquired image compared with the source Correct answer.
  2. A note in the case file listing the drive serial number
  3. A screenshot of the directory listing taken at seizure
  4. An antivirus scan report of the imaged drive

Explanation

A hash computed over the source and the image, matching before and after analysis, demonstrates bit-level integrity. Directory screenshots, serial notes, and malware scans do not detect changes to the data. Hash verification is the accepted technical proof of non-alteration.

Question 5Network Forensics Fundamentals and Legal Considerations

An analyst captures traffic directly on a compromised host's NIC while also collecting NetFlow from the border router. What is the primary forensic advantage of correlating the two sources?

  1. Flow records replace the need for any packet-level capture
  2. Host capture shows payload content while flow records show broader network context and timing Correct answer.
  3. NetFlow provides full packet payloads that confirm the host capture
  4. Correlation guarantees attribution of the attacker's identity

Explanation

Packet capture yields payload and protocol detail, while flow records summarize who talked to whom across the network over time. Combining them places host-level activity in a wider traffic context and helps spot related sessions. Flow data lacks payload, and neither source establishes identity by itself.

Question 6Network Forensics Fundamentals and Legal Considerations

Which legal concept allows a law enforcement officer to seize a laptop during a lawful arrest without first obtaining a separate warrant for the device?

  1. Exigent circumstances
  2. Plain view doctrine
  3. Consent search
  4. Search incident to arrest Correct answer.

Explanation

A search incident to a lawful arrest permits seizure of items on or near the arrestee to prevent destruction of evidence and protect officers. Plain view requires lawful presence plus immediately apparent incriminating character; exigency and consent are distinct exceptions. Device seizure under this doctrine still has limits on later searching of its contents.

Question 7Network Forensics Fundamentals and Legal Considerations

Under the Electronic Communications Privacy Act, which category of stored communication historically received the strongest statutory privacy protection from government access?

  1. Non-content records such as subscriber billing information
  2. Header information of email in transit
  3. Content of communications in electronic storage for 180 days or less Correct answer.
  4. Publicly posted social media content

Explanation

The Stored Communications Act, part of the ECPA, gives greater protection to communications held in electronic storage for 180 days or less, generally requiring a warrant. Older stored content and non-content records had weaker standards, though later cases shifted practice toward warrants. Subscriber records and public postings receive less protection.

Question 8Network Forensics Fundamentals and Legal Considerations

An investigator wants to examine a suspect's cloud storage account. Why is the location of the data legally significant?

  1. Cloud providers cannot be compelled to produce any records
  2. Data in the cloud is considered volatile and exempt from preservation duties
  3. Cloud data is always outside any jurisdiction and therefore unregulated
  4. The physical storage location determines which country's legal process and privacy laws apply Correct answer.

Explanation

Because cloud data resides on servers in specific jurisdictions, the applicable legal process, privacy statutes, and mutual legal assistance routes depend on where the data is stored. Providers can be compelled through proper legal process, and cloud data is not exempt from preservation. Jurisdictional analysis is central to lawful acquisition.

Question 9Network Forensics Fundamentals and Legal Considerations

What is the primary purpose of maintaining a chain-of-custody record for a network capture file?

  1. To assign blame to the analyst who collected the data
  2. To document every transfer and access of the evidence from collection through disposition Correct answer.
  3. To decode encrypted application-layer protocols automatically
  4. To compress the capture file for efficient storage

Explanation

Chain of custody is an auditable record showing who handled the evidence, when, and for what purpose, supporting authenticity in court. It does not compress, decrypt, or assign blame. Any gap in the record can undermine the evidence's admissibility.

Question 10Network Forensics Fundamentals and Legal Considerations

Which capture configuration best supports lawful, minimally intrusive monitoring of only a suspect's traffic on a switched network?

  1. Mirror the entire uplink to the internet and filter later
  2. Enable promiscuous mode on all workstations simultaneously
  3. Capture only broadcast traffic on the local segment
  4. Apply a capture filter targeting the suspect's IP and MAC addresses on the monitored port Correct answer.

Explanation

Targeted filtering limits collection to relevant traffic, supporting proportionality and reducing exposure of unrelated users' data. Mirroring the whole uplink or enabling promiscuous mode broadly collects third-party traffic. Broadcast-only capture would miss the suspect's unicast sessions.

Question 11Network Forensics Fundamentals and Legal Considerations

An analyst needs to prove that a captured file was not modified after collection. Which action provides the strongest evidence?

  1. Compute a SHA-256 hash at collection and recompute it before analysis Correct answer.
  2. Rename the file with a timestamp prefix
  3. Store the file on a write-once medium without recording a hash
  4. Email the file to a colleague for a second opinion

Explanation

Recording a strong cryptographic hash at collection and verifying it later demonstrates the file's contents are unchanged. Renaming and emailing do not detect alteration, and write-once storage without a baseline hash cannot prove integrity. The hash comparison is the defensible proof.

Question 12Network Forensics Fundamentals and Legal Considerations

Which statement about the admissibility of packet captures in court is most accurate?

  1. Captures require no documentation if they contain plaintext payloads
  2. Any packet capture is automatically admissible because it is machine-generated
  3. Captures must be authenticated and shown to be reliably collected and preserved Correct answer.
  4. Captures are inadmissible unless taken by law enforcement

Explanation

Machine-generated records still must be authenticated, and the collection method must be shown reliable and the data preserved intact. Automatic admissibility, law-enforcement-only rules, and documentation exemptions are incorrect. Foundation testimony and integrity records are typically required.

Question 13Network Forensics Fundamentals and Legal Considerations

A suspect used a VPN, and the analyst can see only encrypted tunnel traffic on the local capture. What is the most defensible next step for attribution?

  1. Assert the suspect's identity from the encrypted packet timestamps alone
  2. Conclude the traffic is unrelated because it is encrypted
  3. Decrypt the tunnel by brute-forcing the VPN cipher
  4. Correlate VPN endpoint logs obtained through lawful process with local flow timing Correct answer.

Explanation

When payloads are encrypted, attribution depends on correlating metadata such as flow timing and volume with endpoint logs lawfully obtained from the VPN provider. Timestamps alone cannot identify a person, brute-forcing modern VPN ciphers is infeasible, and encrypted traffic may still be highly relevant.

Question 14Network Forensics Fundamentals and Legal Considerations

Which of the following best describes the role of a network tap compared with a span port for forensic collection?

  1. A tap passively copies traffic in line and generally provides more faithful capture than a mirrored port Correct answer.
  2. A tap actively blocks malicious traffic while recording it
  3. A tap requires enabling promiscuous mode on all hosts
  4. A tap captures only encrypted traffic

Explanation

A hardware tap sits inline and copies frames without relying on the switch's mirroring capacity, so it typically yields more complete captures. It does not block traffic, does not require host configuration, and is not limited to encrypted traffic. This fidelity matters when capture completeness is challenged.

Question 15Network Forensics Fundamentals and Legal Considerations

An analyst reviews logs and finds that NTP is not synchronized across network devices. How does this most affect forensic conclusions?

  1. It automatically invalidates all log evidence
  2. It has no effect because log timestamps are always in UTC
  3. It complicates correlating events across devices and can misorder the timeline Correct answer.
  4. It prevents packet capture from functioning

Explanation

Unsynchronized clocks introduce skew that can reorder events when logs from multiple devices are merged into a timeline. Timestamps are not automatically UTC, capture still works, and the evidence is not automatically invalid but must be interpreted with the skew in mind. Documenting time offsets is essential.

Question 16Network Forensics Fundamentals and Legal Considerations

Which action best preserves volatile network state on a running server before it is shut down for imaging?

  1. Delete temporary files to reduce image size
  2. Immediately power off the server to freeze the disk
  3. Capture active connections, ARP cache, and routing table, then acquire memory Correct answer.
  4. Disable logging to prevent overwriting older entries

Explanation

Volatile state such as connection tables, ARP cache, routing information, and memory contents is lost on shutdown, so it is collected first. Powering off destroys that state, and deleting files or disabling logging alters evidence. Preservation precedes disk imaging.

Question 17Network Forensics Fundamentals and Legal Considerations

A court order authorizes interception of a specific suspect's communications. Which practice keeps the collection within the order's scope?

  1. Limiting interception to the identified selector and time window specified in the order Correct answer.
  2. Extending the interception period without notifying the issuing authority
  3. Retaining unrelated third-party conversations indefinitely
  4. Intercepting all users on the subnet to ensure nothing is missed

Explanation

Interception must stay within the selector, duration, and minimization terms the order specifies. Capturing all subnet users, keeping unrelated conversations, or extending duration unilaterally exceeds authority. Minimization protects uninvolved parties and supports admissibility.

Question 18Network Forensics Fundamentals and Legal Considerations

Which record type from a firewall most directly supports a finding that an internal host initiated a connection to a known malicious IP?

  1. Firmware version history
  2. Configuration backup of the firewall ruleset
  3. Outbound connection logs showing source host, destination IP, port, and timestamp Correct answer.
  4. Interface error counters

Explanation

Outbound connection logs capture the source host, destination, port, and time needed to show the initiation. Error counters, rule backups, and firmware history describe device state, not session activity. The log entry links the internal host to the external destination.

Question 19Network Forensics Fundamentals and Legal Considerations

In a case involving data stored by a US provider for a foreign customer, why might investigators pursue a mutual legal assistance treaty rather than a direct subpoena?

  1. Treaties allow bypassing all privacy laws of the storage country
  2. MLATs provide a formal channel to obtain evidence held abroad in compliance with both jurisdictions Correct answer.
  3. Treaties eliminate the need for chain-of-custody documentation
  4. A subpoena is never valid for any electronic records

Explanation

When evidence is held in another country, an MLAT provides an agreed legal channel that respects both jurisdictions' requirements. Treaties do not override privacy law or remove custody obligations, and subpoenas can be valid in many circumstances. The choice depends on where the data sits and the applicable rules.

Question 20Network Forensics Fundamentals and Legal Considerations

Which practice best supports reproducibility of a network forensic analysis?

  1. Sharing only the final conclusions without supporting data
  2. Documenting tools, versions, filters, and steps so another analyst can repeat the process Correct answer.
  3. Relying on memory of the commands used during collection
  4. Deleting intermediate files after each step

Explanation

Reproducibility requires recording the tools, versions, capture filters, and analytical steps so the work can be independently repeated and verified. Relying on memory, omitting supporting data, or deleting intermediates prevents verification. Good documentation strengthens the report's credibility.

Question 21Network Protocols and Traffic Analysis

A network engineer captures traffic and needs to identify the protocol operating at the transport layer that provides connection-oriented, reliable delivery with sequence numbers and acknowledgments. Which protocol matches this description?

  1. UDP
  2. ICMP
  3. ARP
  4. TCP Correct answer.

Explanation

TCP is the connection-oriented transport protocol that establishes a session via a three-way handshake and guarantees ordered, reliable delivery using sequence numbers and acknowledgments. UDP is connectionless and does not guarantee delivery, while ICMP and ARP operate at different layers and purposes.

Question 22Network Protocols and Traffic Analysis

During a packet capture review, an analyst observes a host sending a frame with destination MAC address FF:FF:FF:FF:FF:FF. What is the analyst seeing?

  1. A multicast frame for a routing protocol group
  2. A frame with a corrupted checksum field
  3. A unicast frame addressed to a single NIC
  4. A broadcast frame destined for all hosts on the local segment Correct answer.

Explanation

The all-ones MAC address FF:FF:FF:FF:FF:FF is the reserved layer-2 broadcast address, so every NIC on the local broadcast domain accepts and processes the frame. Unicast and multicast addresses have distinct bit patterns and are not all ones.

Question 23Network Protocols and Traffic Analysis

A capture shows a DNS query sent to UDP port 53. Which statement best describes why DNS commonly uses UDP for standard queries?

  1. UDP encrypts the payload for confidentiality
  2. UDP guarantees retransmission of lost queries
  3. UDP avoids handshake overhead, keeping single-query resolution fast Correct answer.
  4. UDP provides built-in authentication of responses

Explanation

Standard DNS queries are small and benefit from UDP's connectionless nature, which avoids the TCP three-way handshake and reduces latency for a single request-response exchange. UDP provides no encryption, reliability, or authentication on its own.

Question 24Network Protocols and Traffic Analysis

An analyst filters a capture for ICMP traffic and sees a Type 3 Code 3 message returned to a sending host. What does this message indicate?

  1. Network redirect to a better gateway
  2. Time-to-live exceeded in transit
  3. Echo request reached the destination
  4. Destination port unreachable Correct answer.

Explanation

ICMP Type 3 is Destination Unreachable, and Code 3 specifically means Port Unreachable, typically returned when no process is listening on the target UDP port. Type 0 is echo reply, Type 11 is time exceeded, and Type 5 is redirect.

Question 25Network Protocols and Traffic Analysis

A packet capture shows a TCP segment with the SYN flag set and the ACK flag clear. What is the role of this segment in the connection lifecycle?

  1. It acknowledges previously received data
  2. It resets a stalled session
  3. It closes an established connection
  4. It initiates a new connection Correct answer.

Explanation

A segment with only SYN set is the first step of the TCP three-way handshake, requesting a new connection. FIN closes connections, ACK acknowledges data, and RST aborts a session.

Question 26Network Protocols and Traffic Analysis

While reviewing a capture, an analyst needs to identify the well-known port used by HTTPS by default. Which port number should the analyst filter on?

  1. 25
  2. 21
  3. 3389
  4. 443 Correct answer.

Explanation

HTTPS uses TCP port 443 by default. Port 21 is FTP control, port 25 is SMTP, and port 3389 is RDP.

Question 27Network Protocols and Traffic Analysis

An analyst wants to view only HTTP requests in a capture. Which display filter correctly isolates GET requests sent to a web server?

  1. ip.addr == 80
  2. udp.port == 80
  3. http.request.method == "GET" Correct answer.
  4. tcp.port = 80

Explanation

The display filter http.request.method == "GET" matches only HTTP request packets whose method field equals GET. Port filters would include all traffic on the port, IP address filters cannot use a port number, and HTTP uses TCP not UDP.

Question 28Network Protocols and Traffic Analysis

A capture reveals a host repeatedly sending ARP requests asking for the MAC address of the default gateway even though the gateway is active. Which condition best explains this behavior?

  1. The ARP cache entry has expired or is being refreshed Correct answer.
  2. The host has a static ARP entry configured
  3. The gateway is using IPv6 instead of IPv4
  4. The switch is blocking all broadcast traffic

Explanation

ARP cache entries age out, so a host periodically re-issues ARP requests to refresh the mapping of gateway IP to MAC. If broadcasts were blocked, the request would not appear in the capture at all, and a static entry would suppress the need to query.

Question 29Network Protocols and Traffic Analysis

An analyst observes a TCP conversation where the sender's advertised window size drops to zero. What does this signal about the connection?

  1. The connection has been reset by a firewall
  2. The sender is performing a slow-start ramp-up
  3. The receiver's buffer is full and the sender should pause transmission Correct answer.
  4. The sender has detected packet loss and is retransmitting

Explanation

A zero window advertisement means the receiver's receive buffer is full, instructing the sender to stop sending until a window update is received. It is a flow-control signal, distinct from congestion control or connection reset.

Question 30Network Protocols and Traffic Analysis

A capture shows a TCP handshake completing, followed by data transfer, then a segment with FIN and ACK flags from the client. What is the client signaling?

  1. It is initiating a new session
  2. It is requesting a larger window
  3. It wants to retransmit lost data
  4. It has finished sending and wants to close its half of the connection Correct answer.

Explanation

A FIN flag indicates the sender has no more data to send and is closing its half of the connection, which the peer acknowledges before closing its own direction. Retransmission uses data segments, window changes use the window field, and new sessions begin with SYN.

Question 31Network Protocols and Traffic Analysis

An analyst sees many TCP segments with the PSH flag set during an interactive session. What does the PSH flag accomplish?

  1. It requests that the sender reduce its segment size
  2. It signals that the connection should be reset
  3. It forces the receiver to deliver buffered data to the application immediately Correct answer.
  4. It marks the segment for high-priority routing

Explanation

The PSH flag tells the receiving stack to push buffered data up to the application without waiting for the buffer to fill, which suits interactive traffic. It does not affect routing priority, segment size, or connection state.

Question 32Network Protocols and Traffic Analysis

A capture shows an HTTP response with status code 302 and a Location header. How should the analyst interpret this?

  1. The request was malformed and rejected
  2. The server encountered an internal error
  3. The requested resource was permanently moved and cached
  4. The client is being redirected to a different URL Correct answer.

Explanation

HTTP 302 is Found, a temporary redirect that instructs the client to fetch the resource from the URL in the Location header. Permanent moves use 301, server errors use 5xx, and malformed requests use 400.

Question 33Network Protocols and Traffic Analysis

A capture shows a DHCP exchange with messages in the order Discover, Offer, Request, Acknowledge. Which statement correctly describes the addressing used in the initial Discover message?

  1. Source of the client to destination of the gateway
  2. Source 0.0.0.0 to destination 255.255.255.255 Correct answer.
  3. Source of the server to destination of the client
  4. Source of the relay agent to destination of the server

Explanation

A DHCP client without an address sends Discover from 0.0.0.0 to the limited broadcast address 255.255.255.255 so any DHCP server on the segment can respond. The DHCP server replies in the Offer, and relay agents are used only when servers are on another subnet.

Question 34Network Protocols and Traffic Analysis

An analyst filters a capture for "tcp.analysis.retransmission" and observes repeated segments with identical sequence numbers. What is the most likely cause?

  1. Packets were lost and the sender retransmitted unacknowledged data Correct answer.
  2. The connection is being gracefully closed
  3. The sender is fragmenting IP packets
  4. The receiver is advertising a larger window

Explanation

Retransmissions occur when the sender does not receive an acknowledgment before a timer expires or duplicate ACKs indicate loss, so it resends the same sequence range. Window advertisements, teardown, and fragmentation do not produce duplicate sequence numbers.

Question 35Network Protocols and Traffic Analysis

A capture contains a packet with IP protocol number 6 and TCP destination port 22. Which service is most likely being accessed?

  1. Simple mail transfer
  2. File transfer over FTP
  3. Domain name resolution
  4. Secure Shell remote administration Correct answer.

Explanation

TCP port 22 is the well-known port for SSH, used for encrypted remote administration. DNS uses port 53, SMTP uses 25, and FTP control uses 21.

Question 36Network Protocols and Traffic Analysis

An analyst examining a capture notices that a single HTTP response is split across multiple TCP segments, each with the same acknowledgment number from the client until the final segment arrives. What explains this pattern?

  1. The server is changing its source port mid-transfer
  2. The client is using delayed cumulative acknowledgments Correct answer.
  3. The client has reset the connection
  4. The server is retransmitting the same data repeatedly

Explanation

TCP acknowledgments are cumulative, so a receiver may acknowledge only the highest contiguous byte received; with delayed ACK it may wait before acknowledging multiple segments. This produces repeated ACK numbers while in-order segments arrive, unlike retransmissions which resend data.

Question 37Network Protocols and Traffic Analysis

A capture shows an ICMP echo request sent to a remote host with the TTL field set to 1. What response should the analyst expect from the first router?

  1. An echo reply from the destination
  2. A TCP reset from the router
  3. An ICMP time exceeded message from the router Correct answer.
  4. A destination unreachable message from the destination

Explanation

When a router decrements the TTL to zero, it discards the packet and returns ICMP Type 11 Time Exceeded, which is the mechanism traceroute relies on. The packet never reaches the destination, and routers do not send TCP resets for IP packets.

Question 38Network Protocols and Traffic Analysis

An analyst wants to follow a single TCP stream in a capture tool to reconstruct application data. Which characteristic allows the tool to reassemble the stream correctly?

  1. Each segment carries the full application payload independently
  2. The IP identification field orders the segments
  3. Each segment carries a unique sequence number ordering the bytes Correct answer.
  4. The Ethernet preamble marks segment boundaries

Explanation

TCP sequence numbers identify the byte offset of each segment, enabling the capture tool to order and reassemble the stream even if segments arrive out of order. IP identification supports fragment reassembly, and Ethernet framing does not order TCP segments.

Question 39Network Protocols and Traffic Analysis

During a capture, an analyst observes a host sending a gratuitous ARP. What is the primary purpose of this message?

  1. To request an IP address from a DHCP server
  2. To establish a TCP connection to a peer
  3. To resolve a domain name to an IP address
  4. To announce or update an IP-to-MAC mapping without a prior request Correct answer.

Explanation

A gratuitous ARP is sent without a preceding request to announce a host's IP-to-MAC mapping, often to detect duplicate addresses or update peers after a change such as failover. It does not involve DHCP, DNS, or TCP.

Question 40Network Protocols and Traffic Analysis

A capture shows a TCP segment with the RST flag set arriving from a server in response to a client's SYN. What is the most likely interpretation?

  1. The server is performing a graceful shutdown
  2. The client requested a larger receive window
  3. The server accepted the connection and began data transfer
  4. No service is listening on the requested port or a firewall is rejecting the connection Correct answer.

Explanation

A RST in response to a SYN means the connection attempt was refused, commonly because no process is listening on that port or a firewall is actively rejecting it. Acceptance would produce SYN-ACK, and graceful shutdown uses FIN.

Question 41Network Protocols and Traffic Analysis

An analyst observes a series of TCP segments where the sender's congestion window grows rapidly at first, then increases more slowly after reaching the slow-start threshold. Which congestion-control phase is being observed after the threshold?

  1. Slow start
  2. Zero-window probing
  3. Fast recovery
  4. Congestion avoidance Correct answer.

Explanation

After the congestion window reaches the slow-start threshold, TCP enters congestion avoidance, where the window grows more conservatively, typically by one segment per round-trip time. Slow start is the earlier exponential phase, fast recovery follows loss events, and zero-window probing addresses a full receiver buffer.

Question 42Network Protocols and Traffic Analysis

A capture shows a DNS response with the TC (truncation) bit set. How should the analyst expect the client to proceed?

  1. Discard the response and wait for a push notification
  2. Retry the query over TCP to obtain the full response Correct answer.
  3. Accept the truncated answer as complete
  4. Send the query to a different root server

Explanation

When a DNS response exceeds the UDP size limit, the server sets the TC bit to indicate truncation, and the client is expected to retry the query over TCP to receive the complete answer. The truncated response should not be treated as complete.

Question 43Network Protocols and Traffic Analysis

An analyst sees a TCP connection where the receiver's window is nonzero but the sender stops transmitting and later resumes after receiving an ACK with a larger window. Which mechanism best explains the sender's pause?

  1. Nagle's algorithm delaying small segments
  2. Congestion control based on the congestion window
  3. Path MTU discovery reducing segment size
  4. Flow control based on the advertised receive window Correct answer.

Explanation

The sender limits outstanding unacknowledged data to the receiver's advertised window, so a small window can pause transmission until a larger window is advertised. Congestion control reacts to network loss signals, Nagle coalesces small writes, and PMTU discovery adjusts segment size rather than pausing on window size.

Question 44Network Protocols and Traffic Analysis

A capture contains an IPv4 packet with the DF (Don't Fragment) flag set and a length larger than the next hop's MTU. What will a router do when forwarding it?

  1. Forward it unchanged regardless of MTU
  2. Reassemble the packet at the router before forwarding
  3. Drop the packet and return an ICMP fragmentation-needed message Correct answer.
  4. Fragment the packet into smaller pieces

Explanation

With DF set, a router cannot fragment the packet, so if it exceeds the next-hop MTU the router drops it and sends ICMP Destination Unreachable with the fragmentation-needed code, which drives path MTU discovery. Reassembly at a router is not permitted, and forwarding unchanged would violate the link MTU.

Question 45Network Protocols and Traffic Analysis

An analyst observes an HTTP/1.1 conversation where multiple requests are sent over the same TCP connection without waiting for each response, but responses arrive in request order. Which mechanism is being used?

  1. HTTP persistent connection without pipelining
  2. HTTP pipelining Correct answer.
  3. HTTP/2 stream multiplexing
  4. TLS session resumption

Explanation

HTTP pipelining allows a client to send multiple requests on one connection without waiting for each response, and the server must return responses in the same order. Persistent connections without pipelining still send one request at a time, HTTP/2 multiplexes independent streams, and TLS resumption concerns session security.

Question 46Network Protocols and Traffic Analysis

A capture shows an IPv4 packet whose protocol field contains the value 17. Which transport protocol does this value identify?

  1. TCP
  2. ICMPv6
  3. UDP Correct answer.
  4. ICMP

Explanation

The IPv4 protocol field identifies the payload protocol carried inside the packet; the assigned value 17 corresponds to UDP. Analysts use this field to distinguish transport protocols before inspecting ports, and UDP is connectionless, so no handshake precedes the payload.

Question 47Network Protocols and Traffic Analysis

An analyst filters a capture for DNS traffic and sees a query for a name sent to the configured resolver, followed by a response with answer count zero and no error code. What does this result indicate?

  1. The resolver refused to answer the query
  2. The name exists but has no address record of the requested type Correct answer.
  3. The query was malformed and rejected by the server
  4. The response was truncated and must be retried over TCP

Explanation

A response with RCODE 0 (NOERROR) and an empty answer section is a successful lookup with no records of the requested type, commonly seen for names that exist only with other record types. A refusal would carry RCODE 5, and truncation would be signaled by the TC bit rather than an empty answer.

Question 48Network Protocols and Traffic Analysis

An analyst examining a capture sees a host periodically send an ICMPv6 Neighbor Solicitation for a peer's address and receive a Neighbor Advertisement in reply. Which function does this exchange perform?

  1. Discovering available routers on the local segment
  2. Testing end-to-end path MTU to a remote destination
  3. Resolving an IPv6 address to a link-layer address Correct answer.
  4. Assigning a globally unique address to the interface

Explanation

ICMPv6 Neighbor Solicitation and Neighbor Advertisement messages implement address resolution, mapping an IPv6 address to a MAC address on the local link. Router discovery uses Router Solicitation and Advertisement messages, and address configuration relies on Router Advertisements or DHCPv6.

Question 49Network Protocols and Traffic Analysis

A capture shows a client opening a TCP connection to a server, and the SYN-ACK from the server carries a window scale option with shift count 7. How should the analyst interpret subsequent window values advertised by the server?

  1. Multiply each advertised window field by 128 to obtain the true receive window Correct answer.
  2. Multiply each advertised window field by 7 to obtain the true receive window
  3. Ignore the option because window scaling applies only to the client side
  4. Treat the advertised window field as the exact receive window without adjustment

Explanation

The window scale option specifies a shift count, and the true receive window equals the 16-bit window field left-shifted by that count, which is a multiplication by 2^7, or 128. Scaling is negotiated during the handshake and applies independently to each direction of the connection.

Question 50Network Protocols and Traffic Analysis

An analyst reviews a capture of a TLS session and sees the client and server exchange Change Cipher Spec followed by Finished messages, after which application data flows. Which statement best characterizes what the analyst can determine from this capture without additional key material?

  1. The certificate exchange is encrypted and therefore cannot be located in the capture
  2. Only the TCP ports are visible because the entire TLS record stream is encapsulated
  3. Both the handshake and the application payload are readable because the session is established
  4. Handshake metadata such as negotiated version and SNI is visible, but application payload remains encrypted Correct answer.

Explanation

In TLS, the handshake portion up to the point where keys take effect is sent in the clear, exposing parameters such as the negotiated version and the SNI extension, while application records are protected by the negotiated keys. Decrypting the payload requires session keys, for example supplied through a key log file.