Computer Hacking Forensic Investigator CHFI practice test

Which TWO of the following are valid reasons for using a hardware write blocker during disk acquisition? (Choose two.)

Trap 1: It compresses the acquired data to save storage space

Compression is a feature of imaging tools, not write blockers.

Trap 2: It increases the speed of data acquisition

Write blockers do not affect transfer speed.

Trap 3: It creates a forensic image of the drive

The write blocker does not create an image; it only prevents writes.

A
It compresses the acquired data to save storage space
Why wrong: Compression is a feature of imaging tools, not write blockers.
B
It increases the speed of data acquisition
Why wrong: Write blockers do not affect transfer speed.
C
It allows the source drive to be connected to a forensic workstation without risking modification
The write blocker presents the drive as read-only to the host system.
D
It prevents any accidental writes to the source drive
Hardware write blockers physically prevent write commands from reaching the drive.
E
It creates a forensic image of the drive
Why wrong: The write blocker does not create an image; it only prevents writes.

Question 2hardmultiple choice

During a forensic investigation, an analyst needs to acquire the contents of a live server's RAM without altering the evidence. Which tool and technique should the analyst use to minimize the footprint on the system?

Trap 1: Install FTK Imager on the server and capture memory to a network…

Installing FTK Imager writes to the disk, altering the evidence.

Trap 2: Use a remote acquisition tool over SSH to capture memory to a…

Remote tools may cause network traffic and memory changes.

Trap 3: Use the built-in task manager to create a memory dump and save it…

Using task manager writes the dump to disk, potentially overwriting evidence.

A
Install FTK Imager on the server and capture memory to a network share
Why wrong: Installing FTK Imager writes to the disk, altering the evidence.
B
Run a trusted version of win32dd.exe from a write-protected USB drive and capture memory to the USB
Running from a write-protected USB minimizes changes; capturing to USB avoids writing to the system drive.
C
Use a remote acquisition tool over SSH to capture memory to a remote server
Why wrong: Remote tools may cause network traffic and memory changes.
D
Use the built-in task manager to create a memory dump and save it locally
Why wrong: Using task manager writes the dump to disk, potentially overwriting evidence.

Question 3hardmultiple choice

You are a forensic investigator responding to a data breach at a mid-sized company. The company uses a hybrid cloud environment with AWS for production workloads and on-premises servers for legacy applications. The breach was detected when an internal monitoring system flagged unusual outbound traffic from an AWS EC2 instance (i-0a1b2c3d4e5f) to an external IP address (198.51.100.20) on TCP port 4444 during off-hours. The EC2 instance runs a Linux-based web server. The security team has already isolated the instance by removing its security group rules and stopping the instance. You have been provided with the following: (1) AWS CloudTrail logs for the past 72 hours, (2) VPC Flow Logs for the same period, (3) a snapshot of the instance’s root volume (EBS), and (4) the instance metadata log from the AWS console. The company’s incident response policy requires preservation of all volatile data before powering off the instance. Which of the following steps should you take FIRST to ensure a forensically sound investigation?

Trap 1: Acquire a memory dump from the stopped instance by re-attaching the…

Memory is volatile and lost when the instance is stopped; cannot be acquired after power-off.

Trap 2: Review the instance metadata log to identify the user who launched…

Metadata is not disk evidence; disk preservation is higher priority.

Trap 3: Analyze the VPC Flow Logs to determine if other instances…

While useful, this is an analysis step, not the first preservation step.

A
Acquire a memory dump from the stopped instance by re-attaching the root volume to a forensic workstation.
Why wrong: Memory is volatile and lost when the instance is stopped; cannot be acquired after power-off.
B
Review the instance metadata log to identify the user who launched the instance.
Why wrong: Metadata is not disk evidence; disk preservation is higher priority.
C
Create a forensic copy of the EBS snapshot and attach it to a separate analysis EC2 instance in a different AWS account to avoid altering evidence.
The snapshot is the only disk evidence; making a copy in a separate account prevents accidental modification.
D
Analyze the VPC Flow Logs to determine if other instances communicated with the same external IP.
Why wrong: While useful, this is an analysis step, not the first preservation step.

Question 4hardmulti select

Which TWO of the following are valid techniques for collecting volatile network evidence from a live system during incident response?

Trap 1: Using route print to view the IP routing table.

Routing table is relatively static and not volatile evidence of current activity.

Trap 2: Using ipconfig /displaydns to view the DNS resolver cache.

DNS cache is not directly network evidence; it's a cached resolution.

Trap 3: Running arp -a to view the ARP table.

ARP table is volatile but not as indicative of active network connections.

A
Using route print to view the IP routing table.
Why wrong: Routing table is relatively static and not volatile evidence of current activity.
B
Using ipconfig /displaydns to view the DNS resolver cache.
Why wrong: DNS cache is not directly network evidence; it's a cached resolution.
C
Running arp -a to view the ARP table.
Why wrong: ARP table is volatile but not as indicative of active network connections.
D
Running netstat -an to view active TCP/UDP connections.
Active connections are volatile and show current network activity.
E
Executing tcpdump -i eth0 -w capture.pcap to capture live packets.
Live packet capture is volatile network evidence.

Question 5mediummulti select

A first responder is responding to a ransomware incident on a Windows server. Which TWO actions should be performed to preserve evidence? (Choose two.)

Trap 1: Run an antivirus scan to remove the ransomware.

Running AV alters the system and may destroy evidence.

Trap 2: Restore the system from backup to minimize downtime.

Restoration destroys the current state and evidence.

Trap 3: Disconnect the network cable immediately.

Disconnecting may lose network evidence; should be done after memory capture.

A
Run an antivirus scan to remove the ransomware.
Why wrong: Running AV alters the system and may destroy evidence.
B
Power off the server to prevent further data encryption.
Powering off stops the ransomware and preserves the disk state.
C
Restore the system from backup to minimize downtime.
Why wrong: Restoration destroys the current state and evidence.
D
Capture a memory dump using a forensic tool.
Memory contains encryption keys and running processes.
E
Disconnect the network cable immediately.
Why wrong: Disconnecting may lose network evidence; should be done after memory capture.

Question 6easymultiple choice

Refer to the exhibit. A first responder runs the netstat command on a compromised Windows workstation. Which of the following conclusions is BEST supported by the output?

Exhibit

Refer to the exhibit.

C:\Users\Forensic> netstat -ano

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    192.168.1.10:49152     10.2.3.4:443           ESTABLISHED     1234
  TCP    192.168.1.10:49153     192.168.1.1:80         TIME_WAIT       0
  TCP    192.168.1.10:49154     10.2.3.4:80            ESTABLISHED     1234
  UDP    0.0.0.0:5353           *:*                                    5678

Trap 1: The connection to 192.168.1.1:80 is suspicious because it is in…

TIME_WAIT is a normal TCP state for closed connections.

Trap 2: The UDP listener on port 5353 indicates a malware infection.

Port 5353 is commonly used by mDNS (Bonjour) and is often benign.

Trap 3: The workstation is running multiple virtual machines based on the…

Only one local IP is shown.

A
The connection to 192.168.1.1:80 is suspicious because it is in TIME_WAIT state.
Why wrong: TIME_WAIT is a normal TCP state for closed connections.
B
The UDP listener on port 5353 indicates a malware infection.
Why wrong: Port 5353 is commonly used by mDNS (Bonjour) and is often benign.
C
A process with PID 1234 is likely communicating with a remote C2 server at 10.2.3.4.
Process 1234 has two established connections to the same remote IP on different ports.
D
The workstation is running multiple virtual machines based on the local addresses.
Why wrong: Only one local IP is shown.