Question 1

Sniffers put NICs into_________ , forcing them to listen in on all of the communications that are occurring on the network.
A) Covert mode
B) Wiretap mode
C) Promiscuous mode
D) None of the above

Accepted Answer

Sniffers put Network Interface Cards (NICs) into promiscuous mode, which allows the NIC to listen to all traffic on the network, not just the traffic addressed to it.

Question 2

How many bytes per packet does tcpdump capture by default?
A) 10 bytes
B) 68 bytes
C) 128 bytes
D) 1024 bytes

Accepted Answer

tcpdump captures 68 bytes per packet by default. This is a snapshot length that ensures the capture of the headers of most protocols without consuming excessive resources.

Question 3

What is the maximum cable length for a 10BaseT network?
A) 10 feet
B) 100 feet
C) 10 meters
D) 100 meters

Accepted Answer

The maximum cable length for a 10BaseT network is 100 meters. This standard allows for a significant distance for Ethernet networking over twisted pair cables.

Question 4

What is the approximate theoretical maximum number of bytes that can be downloaded in one minute on a 10BaseT network?
A) 10 Mb
B) 75 Mb
C) 100 Mb
D) 175 Mb

Accepted Answer

A 10BaseT network has a maximum throughput of 10 megabits per second (Mbps). To find out how much data can be downloaded in one minute, multiply the rate by the number of seconds in a minute: 10 Mbps * 60 seconds = 600 megabits. Since there are 8 bits in a byte, divide by 8 to convert to megabytes: 600 megabits / 8 = 75 megabytes (Mb).

Question 5

The netstat command can be used to obtain the MAC address of a remote computer.

Accepted Answer

The netstat command is used to display network connections, routing tables, and a number of network interface and network protocol statistics. It does not provide MAC addresses of remote computers, as MAC addresses are typically used for local network communications and are not transmitted across the internet.

Question 6

Which of the following applications is used to capture network traffic?
A) Snort
B) Wireshark
C) Tcpdump
D) All of the above

Accepted Answer

All of the options listed, Snort, Wireshark, and Tcpdump, are tools used for capturing and analyzing network traffic. Snort can function as a network intrusion detection system (NIDS) but also has the capability to capture network packets. Wireshark is a widely used network protocol analyzer that allows users to see what is happening on their network at a microscopic level. Tcpdump is a powerful command-line packet analyzer; it also captures or filters TCP/IP packets that are received or transferred over a network.

Question 7

The transition method in which only one computer can transmit while all the others listen is known as:
A) Baseband
B) Narrowband
C) Broadband
D) Sideband

Accepted Answer

Baseband transmission allows only one device to transmit at a time on the entire bandwidth of the cable, making it a method where one computer transmits while all others listen.

Question 8

It is necessary to physically tap a network cable to capture the traffic it carries.

Accepted Answer

Network traffic can be captured using software tools without the need for physical tapping, such as with packet sniffing software that intercepts and logs traffic passing over a digital network.

Question 9

If a criminal reconfigures his computer with someone else's IP address to conceal his identity, the local router would have an entry in its _________showing that criminal's actual Mac address associated with somebody else's IP address.
A) Host table
B) BOOTP
C) CMOS
D) ARP table

Accepted Answer

The Address Resolution Protocol (ARP) table is used to keep track of IP addresses and their corresponding MAC addresses. If a criminal reconfigures his computer to use someone else's IP address, the local router's ARP table would show the criminal's actual MAC address associated with that IP address, revealing the mismatch and potentially helping in tracking the criminal's actual network identity.

Question 10

ARP stands for:
A) Address Resource Protection
B) Advanced Retrieval Protocol
C) Address Resolution Protocol
D) Added Resource Processing

Accepted Answer

ARP stands for Address Resolution Protocol, which is used to find the physical address (MAC address) of a network device from its IP address within a local network segment.

Question 11

Each network packet stored in the tcpdump file is date-time stamped.

Accepted Answer

tcpdump includes a timestamp for each packet captured, indicating when the packet was intercepted. This allows for detailed analysis of network traffic over time.

Question 12

The best operating system for capturing network traffic on high-speed networks is:
A) Microsoft DOS/Windows
B) OpenBSD/FreeBSD
C) Linux
D) Solaris

Accepted Answer

OpenBSD/FreeBSD is a high-performance operating system that is well-suited for capturing network traffic on high-speed networks. It has a number of features that make it ideal for this purpose, including a high-performance packet capture engine, a flexible filtering system, and a powerful command-line interface.

Question 13

Although ARP is part of TCP/IP, it is generally considered a part of the _________layer.
A) Physical
B) Data-link
C) Network
D) Transport

Accepted Answer

ARP (Address Resolution Protocol) operates at the Data-link layer of the OSI model, which is responsible for resolving the network layer addresses into link layer addresses.

Question 14

Which of the following commands can be used to obtain the MAC address of a remote Windows computer?
A) Netstat
B) Ping
C) Nbtstat
D) Traceroute

Accepted Answer

Nbtstat is used to display protocol statistics and current TCP/IP connections using NBT (NetBIOS over TCP/IP), which can help in obtaining the MAC address of a remote Windows computer when used with the right options. Other options like Ping, Traceroute, and Netstat are used for different purposes such as checking connectivity, tracing route paths, and displaying network connections respectively, but they do not directly provide the MAC address of a remote computer.

Question 15

Which of the following tools can reconstruct TCP streams?
A) Tcpdump
B) Wireshark
C) Snoop
D) EnCase

Accepted Answer

Wireshark has the ability to reconstruct TCP streams and display them in sequence, allowing for easier analysis and troubleshooting of network issues. Tcpdump and Snoop are packet capture tools and do not have the same level of stream reconstruction capabilities as Wireshark. EnCase is a digital forensics tool and is not primarily used for network analysis.

Question 16

Which of the following is a valid MAC address?
A) 192.168.0.5
B) 00:10:4b:de:fc:e9
C) 0-0-e2-7a-c3-5b-6f
D) 08-00-56-s7-fd-d4

Accepted Answer

A MAC address is typically represented in hexadecimal format, divided into pairs by colons or hyphens. Option B, "00:10:4b:de:fc:e9", follows this format correctly, making it a valid MAC address.

Question 17

MAC addresses can be associated with a particular computer.

Accepted Answer

MAC (Media Access Control) addresses are unique identifiers assigned to network interfaces for communications on the physical network segment, effectively associating them with a particular computer or device.

Question 18

The form of ARP that ATM uses to discover MAC addresses is known as:
A) ARPATM
B) ATMARP
C) MACATM
D) ATMMAC

Accepted Answer

ATMARP (ATM Address Resolution Protocol) is used in ATM networks to resolve network layer addresses into ATM addresses, similar to how ARP is used in Ethernet networks to resolve IP addresses into MAC addresses.

Question 19

What is the maximum cable length for a 10 base five segment?
A) 100 feet
B) 500 feet
C) 100 m
D) 500 m

Accepted Answer

10BASE5, also known as Thicknet, has a maximum cable length of 500 meters per segment.

Question 20

Routers use Ethernet addresses to direct data between networks.

Accepted Answer

Routers use IP addresses to direct data between networks, while Ethernet addresses (MAC addresses) are used for local network communication within the same network segment.

Quiz 24: Digital Evidence at the Physical and Data-Link Layers

Sniffers put NICs into_________ , forcing them to listen in on all of the communications that are occurring on the network.

How many bytes per packet does tcpdump capture by default?

What is the maximum cable length for a 10BaseT network?

What is the approximate theoretical maximum number of bytes that can be downloaded in one minute on a 10BaseT network?

The netstat command can be used to obtain the MAC address of a remote computer.

Which of the following applications is used to capture network traffic?

The transition method in which only one computer can transmit while all the others listen is known as:

It is necessary to physically tap a network cable to capture the traffic it carries.

If a criminal reconfigures his computer with someone else's IP address to conceal his identity, the local router would have an entry in its _________showing that criminal's actual Mac address associated with somebody else's IP address.

ARP stands for:

Each network packet stored in the tcpdump file is date-time stamped.

The best operating system for capturing network traffic on high-speed networks is:

Although ARP is part of TCP/IP, it is generally considered a part of the _________layer.

Which of the following commands can be used to obtain the MAC address of a remote Windows computer?

Which of the following tools can reconstruct TCP streams?

Which of the following is a valid MAC address?

MAC addresses can be associated with a particular computer.

The form of ARP that ATM uses to discover MAC addresses is known as:

What is the maximum cable length for a 10 base five segment?

Routers use Ethernet addresses to direct data between networks.