Network Security MCQ Exam

Which tool is essential for capturing and analyzing network packets?

• Netflow
• Tcpdump
• Wireshark
• Nessus

Answer explanation

Wireshark is the standard tool for packet analysis.

What is the primary source of evidence in Network Forensics?

• System Memory
• Network Traffic
• Hard Drive Images
• Email Content

Answer explanation

Network traffic is the core source in network forensics.

The first step in a Forensics Investigation methodology is typically:

• Reporting
• Analysis
• Acquisition
• Automation

Answer explanation

Acquisition (Collection) is the initial phase of evidence handling.

Evidence derived from system records of activity is known as:

• Image-based
• Log-based
• Memory-based
• Flow-based

Answer explanation

Log-based evidence comes from system and application logs.

Understanding basic network layers is covered in the:

• Hacking Guide
• Technical Requirements
• Inter-networking refresher
• Wireshark Essentials

Answer explanation

Inter-networking concepts (TCP/IP, etc.) are fundamental.

The study of network attacks like "hack attempts" is a form of:

• Protocol Analysis
• Statistical Flow
• Case Study
• Log Aggregation

Answer explanation

The syllabus mentions a Case Study on hack attempts.

Deep Packet Inspection (DPI) analyzes the layers of:

• Flow records
• Log files
• Protocol Encapsulation
• Sensor deployment

Answer explanation

DPI inspects the data within the protocol layers.

When one protocol is carried inside another, it is called:

• Fragmentation
• Decapsulation
• Protocol Encapsulation
• Tunneling

Answer explanation

Encapsulation is how protocols are layered in a network stack.

Which protocol analysis involves examining SYN/ACK packets?

• UDP
• ICMP
• TCP
• ARP

Answer explanation

The three-way handshake is characteristic of TCP.

A network attack that floods a target with error messages uses which protocol?

• UDP
• ICMP
• TCP
• HTTP

Answer explanation

ICMP is the Internet Control Message Protocol.