Explain how encrypted information being transmitted on wireless network can still be used to assist in Network Forensics.

What forensic value can one obtain from a switch?

Why are routers considered a rudimentary intrusion detection system?

How could an investigator use information from a DHCP server to help in a forensic investigation?

What aspect of a DNS server log can a network investigator?

How can one use authentication server logs to help identify unauthorized penetration attempts?

What is the difference in capabilities between early system firewalls and current modern firewalls? (Hint: Capabilities?)