Computer Hacking Forensic Investigator (CHFI v10) — Question 86

When investigating a network that uses DHCP to assign IP addresses, where would you look to determine which system (MAC address) had a specific IP address at a specific time?

Answer options

• A. on the individual computer's ARP cache
• B. in the Web Server log files
• C. in the DHCP Server log files
• D. there is no way to determine the specific IP address

Correct answer: C

Explanation

The correct answer is C, as DHCP Server log files maintain records of IP address assignments along with the corresponding MAC addresses. The other options are incorrect because the ARP cache only shows current mappings, Web Server logs do not track DHCP assignments, and option D incorrectly states that it's impossible to determine the specific IP address.