Digital Forensics: Network Security Architecture Applied Scenarios

This FACT-aligned mock test puts the network security architecture block of the digital forensics syllabus into applied form. Thirty scenario-style single-best-answer questions exercise IPSec selection between AH (RFC 4302), ESP (RFC 4303), and the combination, transport versus tunnel mode for site-to-site and remote-access deployments, and IKEv2 (RFC 7296) versus the deprecated IKEv1 Aggressive Mode. VPN selection between OpenVPN, WireGuard, and IPSec is tested against use-case constraints. Firewall design covers stateful inspection, application proxies, and next-generation firewalls when layer-7 inspection plus user identity are required. IDS versus IPS placement (passive tap versus inline) and the signature-versus-anomaly gap on zero-day traffic are explored alongside PEAP versus EAP-TLS choices given certificate-management realities, Kerberos AS-TGS-KDC troubleshooting under RFC 4120 error codes, X.509 chain validation, LDAP distinguished names, digital signature verification, CRL versus OCSP under RFC 5280 and RFC 6960, TLS 1.2 versus 1.3 handshake changes, HSTS preload reasoning, NAC 802.1X-MAB risk, TOTP versus HOTP versus FIDO2 selection, PKI bridge trust models, VLAN versus micro-segmentation under NIST SP 800-207, SIEM correlation tuning, and IPv6 SLAAC with Privacy Extensions versus stateful DHCPv6.

This medium-band paper is intended for MSc and BSc forensic science aspirants targeting the FACT entrance examination, and for working professionals preparing for CISSP, Security+, or CHFI. Indian PKI material under the Controller of Certifying Authorities and the IT Act 2000 informs the certificate questions, alongside CERT-In hardening advisories and NIST publications.

Topics covered:

• IPSec AH versus ESP versus combined, transport versus tunnel mode selection
• IKEv2 phases against IKEv1 Aggressive Mode deprecation
• VPN selection between OpenVPN, WireGuard, and IPSec for given constraints
• Firewall types: stateful, proxy, and NGFW with TLS decryption and user identity
• IDS passive tap versus IPS inline, and signature limits against zero-day traffic
• PEAP versus EAP-TLS, Kerberos error troubleshooting, X.509 chain failures
• LDAP DN versus RDN, digital signatures, CRL versus OCSP freshness trade-off
• TLS 1.3 handshake, HSTS preload, 802.1X-MAB risk, FIDO2 selection, micro-segmentation

Use this set as a calibration exercise before attempting full-length FACT digital forensics papers. Allow 30 minutes.