Network forensics in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is network forensics?

Network forensics is the process of capturing, recording, and analyzing network traffic to find evidence of cyber attacks or unauthorized activity.

beginner

Name two common tools used in network forensics.

Common tools include Wireshark for packet analysis and tcpdump for capturing network traffic.

beginner

Why is capturing network traffic important in network forensics?

Capturing network traffic helps investigators see exactly what data was sent or received, which can reveal attacks or data breaches.

intermediate

What is the difference between network forensics and network monitoring?

Network monitoring watches traffic in real-time to keep systems running smoothly, while network forensics analyzes past traffic to investigate incidents.

beginner

How does network forensics help in cybersecurity?

It helps find how attacks happened, what was affected, and who did it, so organizations can fix problems and prevent future attacks.

What is the main goal of network forensics?

A To create new network protocols

B To analyze network traffic for evidence of cyber attacks

C To block all incoming network traffic

D To speed up internet connection

Network forensics focuses on analyzing network data to find evidence of attacks or unauthorized activity.

Which tool is commonly used to capture and analyze network packets?

A Photoshop

B Excel

C Wireshark

D Notepad

Wireshark is a popular tool for capturing and analyzing network packets.

Network forensics is mostly used to:

A Investigate past network incidents

B Design new websites

C Improve Wi-Fi speed

D Encrypt emails

Network forensics investigates past network traffic to understand incidents.

Which of the following is NOT a purpose of network forensics?

A Real-time network performance monitoring

B Analyzing malware behavior

C Detecting unauthorized access

D Collecting evidence for legal cases

Real-time monitoring is network monitoring, not network forensics which analyzes past data.

What kind of data does network forensics analyze?

A Hardware specifications

B Printed documents

C User passwords only

D Network traffic data

Network forensics analyzes data from network traffic to find evidence.

Explain what network forensics is and why it is important in cybersecurity.

Think about how looking at past network data can help solve cyber problems.

Describe the difference between network monitoring and network forensics.

Consider when and why each process is used.