CHFI Practice Test 12 — 15 Questions

Question 1

A malware analyst is performing dynamic analysis of a suspicious executable in a Cuckoo Sandbox environment. Which THREE of the following behavioural indicators would be considered suspicious and warrant further investigation?

Accepted Answer

Creating a mutex with a hardcoded name. Creating a mutex with a hardcoded name is a common anti-analysis technique used by malware to ensure only one instance runs, preventing multiple infections or sandbox detection. In Cuckoo Sandbox, a hardcoded mutex name (e.g., 'Global\MyMalwareMutex') can indicate a known malware family or a custom implementation, warranting further investigation as it often correlates with persistence or evasion logic.

Answer

Reading registry keys under HKLM\HARDWARE

Answer

Writing a temporary file to %TEMP%

Question 2

A forensic investigator needs to analyze the keychain data from an iOS device backup. Which tool is specifically designed to decrypt and display iOS keychain contents?

Accepted Answer

Elcomsoft Phone Breaker. Elcomsoft Phone Breaker is specifically designed to decrypt and display iOS keychain contents from backups, including passwords, tokens, and cryptographic keys. It leverages techniques such as brute-force, dictionary attacks, and GPU acceleration to recover the backup password, then extracts and decrypts the keychain data using iOS's Keychain Services API.

Answer

Cellebrite UFED

Answer

Oxygen Forensic Detective

Answer

Magnet AXIOM

Question 3

A security analyst runs the command `regshot64.exe compare` after executing malware. Regshot reports that the following registry key was created: `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SecureUpdate`. Which conclusion is MOST likely?

Accepted Answer

The malware installed a persistence mechanism. The registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SecureUpdate` is a standard Windows Run key, which automatically executes the specified program at user logon. By creating this key, the malware ensures it runs every time the user logs in, establishing persistence. This is a classic persistence mechanism, not an action related to encryption, file deletion, or network changes.

Answer

The malware encrypted the user's documents

Answer

The malware deleted a system file

Answer

The malware modified a network configuration

Question 4

A forensic analyst is examining an Android device for evidence of a specific app's usage. Which TWO locations are MOST likely to contain app-specific data that can be recovered through a logical acquisition?

Accepted Answer

/data/data/. Option B is correct because /data/data/ is the primary directory on Android devices where installed applications store their private data, including databases, shared preferences, and cache files. This directory is accessible through logical acquisition (e.g., ADB backup) and contains app-specific evidence such as user credentials, chat logs, and configuration files.

Answer

/system/bin/

Answer

/proc/

Answer

/init.rc

Question 5

Which tool can be used to extract evidence from Android devices through the Android Debug Bridge (ADB) and is often used for logical acquisition?

Accepted Answer

Cellebrite UFED. Cellebrite UFED (Universal Forensic Extraction Device) is a widely used forensic tool that leverages Android Debug Bridge (ADB) to perform logical acquisition of Android devices. ADB allows the tool to communicate with the device's operating system via USB debugging, enabling extraction of call logs, contacts, SMS, and application data without physical chip-off. This makes it the correct choice for logical acquisition over ADB.

Answer

PEiD

Answer

Cuckoo Sandbox

Answer

GrayKey

Question 6

An incident responder finds a file named 'photo.jpg' on a compromised system. The file size is 2 MB and it is located in a temp directory. The file's SHA256 hash is 5d41402abc4b2a76b9719d911017c592. What is the BEST next step to determine if this file is malicious?

Accepted Answer

Compare the hash against known malware hashes in a threat intelligence database. Option C is correct because comparing the SHA256 hash of the file against a threat intelligence database (e.g., VirusTotal, AlienVault OTX) is the fastest, least intrusive method to determine if the file is known malware. Since the file is 2 MB and located in a temp directory, it could be a legitimate image or a disguised executable; hash comparison leverages existing threat intelligence without altering the evidence or risking system compromise.

Answer

Delete the file to prevent potential harm

Answer

Perform static analysis using IDA Pro to disassemble the file

Answer

Run the file in a sandbox environment to observe behavior

Question 7

A forensic investigator is analyzing a Windows system suspected of malware infection. Which TWO of the following are common persistence mechanisms that malware may use?

Accepted Answer

Scheduled Tasks via schtasks. Scheduled Tasks via schtasks (Option A) are a common persistence mechanism because malware can create a task that runs at system startup or at regular intervals to re-infect or maintain a foothold. The schtasks command allows creating tasks with SYSTEM privileges, often triggered by logon or system boot events, making it a stealthy way to survive reboots.

Answer

Creating a Windows service

Answer

Adding an entry to the hosts file

Answer

Modifying the boot.ini file

Question 8

A malware analyst is using a tool to monitor registry and file system changes during the execution of a suspicious binary. Which tool is specifically designed to take snapshots of the registry and file system before and after execution to identify changes?

Accepted Answer

Regshot. Regshot is a lightweight open-source tool designed specifically to compare registry hives and file system snapshots taken before and after executing a binary. It generates a detailed report of added, modified, or deleted keys and files, making it ideal for malware analysis to quickly identify persistence mechanisms or configuration changes.

Answer

Cuckoo Sandbox

Answer

Process Explorer

Answer

Process Monitor

Question 9

During a malware investigation, an analyst examines a suspicious file that appears to have been timestomped. Which THREE of the following techniques or tools can be used to detect timestamp manipulation on Windows?

Accepted Answer

Examining the file’s $STANDARD_INFORMATION vs $FILE_NAME timestamps using tools like MFT2CSV. Option A is correct because timestomping modifies the $STANDARD_INFORMATION attribute, but the $FILE_NAME attribute retains the original timestamps from when the file was created or renamed. Tools like MFT2CSV parse the MFT to compare these two sets of timestamps; a discrepancy indicates manipulation.

Answer

Capturing network traffic with Wireshark

Answer

Using Regshot to compare registry snapshots

Question 10

A forensic analyst needs to acquire evidence from an iPhone 12 running iOS 15. The device is passcode-locked and cannot be unlocked. Which acquisition method should be used to obtain the MOST data possible?

Accepted Answer

Physical acquisition via GrayKey or Cellebrite. GrayKey and Cellebrite perform physical acquisition by exploiting bootrom or iBoot vulnerabilities (e.g., checkm8 on older devices) or using advanced brute-force techniques to extract the full file system image, including encrypted keychain data and deleted files. This method bypasses the passcode lock and retrieves the maximum amount of data from an iPhone 12 running iOS 15, as logical and manual methods are severely limited by the locked state.

Answer

Logical acquisition via iTunes backup

Answer

Manual acquisition by photographing the screen

Answer

File system acquisition via jailbreak

Question 11

Which of the following is an example of an anti-forensics technique used to hide malicious activity?

Accepted Answer

Timestomping. Timestomping is an anti-forensics technique that deliberately modifies file timestamps (e.g., MAC times: Modified, Accessed, Created) using tools like `touch` on Linux or `SetFileTime` on Windows. By altering these timestamps, an attacker can hide the true timeline of malicious file creation, modification, or access, thereby evading forensic timeline analysis and making it appear that malicious activity occurred at a different time or was part of legitimate system operations.

Answer

Running a sandbox

Answer

Creating a mutex

Answer

Generating a hash

Question 12

During dynamic analysis of a suspected malware sample, an analyst observes the following behaviors: (1) The process creates a service named 'WindowsDefender' that starts automatically. (2) It writes an encrypted payload to the registry under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. (3) It injects code into explorer.exe. (4) It attempts to resolve the domain 'malware-update.com'. (5) It creates a mutex named 'Global\MyMutex'. Which THREE behaviors are indicators of malware persistence? (Select THREE.)

Accepted Answer

Injecting code into explorer.exe. Injecting code into explorer.exe (option A) is a persistence mechanism because the injected code runs within the context of a trusted system process that starts automatically at user logon. By hijacking explorer.exe, the malware ensures its malicious code executes every time the user logs into the system, surviving a reboot without needing a separate startup entry.

Answer

Creating a mutex named 'Global\MyMutex'

Answer

Attempting to resolve the domain 'malware-update.com'

Question 13

During a mobile forensic investigation, an examiner finds that the seized iPhone is locked with a passcode but is running iOS 11. Which acquisition method should the examiner prioritize to obtain the most data without bypassing the passcode?

Accepted Answer

Logical acquisition via iTunes backup. On iOS 11, a locked device prevents physical and file system acquisitions due to hardware encryption and the Secure Enclave. Logical acquisition via iTunes backup is the recommended method because it can extract most user data (contacts, messages, photos) without requiring the passcode to be bypassed, as the backup process is authorized by the device's trust relationship with a previously paired computer.

Answer

Physical acquisition using a JTAG tool

Answer

File system acquisition using Cellebrite UFED

Answer

Manual acquisition by photographing the screen

Question 14

Which TWO of the following are essential requirements for a computer forensics lab according to best practices?

Accepted Answer

Uninterruptible power supply (UPS) and surge protectors. A is correct because a UPS provides temporary power during outages to prevent data loss or corruption during forensic imaging, while surge protectors guard against voltage spikes that could damage sensitive lab equipment. Best practices require both to ensure chain of custody integrity and hardware reliability.

Answer

Offsite cloud storage for all case files

Answer

Shared workstations to reduce hardware costs

Answer

Open wireless network for flexibility

Question 15

A forensic analyst is examining a Windows 10 system and needs to determine the last boot time of the system. Which registry hive and key should the analyst query to find this information?

Accepted Answer

SYSTEM hive, key 'CurrentControlSet\Control\Windows\', value 'ShutdownTime'. The SYSTEM hive stores system-wide configuration data, and the key 'CurrentControlSet\Control\Windows\' contains the 'ShutdownTime' value, which records the last system shutdown time. Since the last boot time is effectively the time after the last shutdown, querying this value provides the necessary information. This is a standard forensic artifact for determining system uptime and boot events on Windows 10.

Answer

NTUSER.DAT hive, key 'Control Panel\Desktop\'

Answer

SOFTWARE hive, key 'Microsoft\Windows NT\CurrentVersion\'

Answer

SAM hive, key 'SAM\Domains\Account\Users\'