CHFI Practice Test 12 — 15 Questions

Question 1

An analyst reviews an Apache access log entry: '192.168.1.10 - - [10/Oct/2023:13:55:36 +0000] "GET /index.php?id=1%27%20OR%20%271%27%3D%271 HTTP/1.1" 200 1234 "-" "Mozilla/5.0"'. Which attack does this log entry most likely indicate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SQL injection (SQLi) attack. The URL-encoded payload contains SQL injection syntax (%27 is a single quote), attempting to inject an OR condition. This is indicative of a SQL injection attempt.

Answer

Cross-site scripting (XSS) attack

Answer

Path traversal attack

Answer

Remote file inclusion (RFI) attack

Question 2

A forensic analyst needs to create a timeline of file system activity from a disk image. Which tool is specifically designed for this purpose and can parse various artifacts such as registry, prefetch, and log files?

Accepted Answer

Plaso (log2timeline). Plaso (log2timeline) is the correct tool because it is specifically designed to create super timelines of file system activity from disk images. It parses a wide range of artifacts including the Windows Registry, Prefetch files, event logs, and other log files, correlating timestamps to reconstruct a chronological sequence of system events.

Answer

Wireshark

Answer

Volatility

Answer

FTK Imager

Question 3

An investigator is analyzing a compromised MySQL database server. To determine the exact time and content of a suspect data exfiltration query, which MySQL log should be examined first, assuming it is enabled?

Accepted Answer

General query log. The general query log records every SQL statement received by the MySQL server, including SELECT queries used for data exfiltration. Since the investigator needs the exact time and content of the suspect query, this log provides a complete, chronological record of all client-sent statements, making it the primary source for identifying the exfiltration event.

Answer

Error log

Answer

Binary log

Answer

Slow query log

Question 4

A network forensics analyst captures traffic from a suspected data exfiltration. In Wireshark, filtering for DNS queries containing a long subdomain with base64-encoded text suggests which technique?

Accepted Answer

DNS tunneling. DNS tunneling encodes data (often base64) into DNS query subdomains to bypass network controls and exfiltrate information. Wireshark filtering for unusually long DNS queries with encoded text directly reveals this technique, as legitimate DNS queries rarely contain such payloads.

Answer

DNS hijacking

Answer

DNS poisoning

Answer

DNS amplification

Question 5

A Windows system is suspected of having malware that maintains persistence by starting every time a user logs in. Which registry key should be examined FIRST for this persistence mechanism?

Accepted Answer

Run keys. The Run keys (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) are the most common and straightforward persistence mechanism for malware that executes on user login. These registry keys specify programs that automatically run when a user logs into their account, making them the first place to check for such persistence.

Answer

ShellBags

Answer

NTUSER.DAT

Answer

HKLM\SAM

Question 6

During a network breach investigation, an analyst examines NetFlow records and sees large data transfers from a server to an external IP address during off-hours. Which type of activity does this MOST likely indicate?

Accepted Answer

Data exfiltration by an attacker. Large data transfers from a server to an external IP address during off-hours are a classic indicator of data exfiltration. NetFlow records capture metadata such as source/destination IPs, ports, and byte counts; a sudden, high-volume outbound flow to an unfamiliar external IP outside normal business hours strongly suggests an attacker is copying sensitive data out of the network, not legitimate traffic.

Answer

Normal software update download

Answer

Scheduled backup to a cloud service

Answer

Denial-of-service attack against the server

Question 7

You are a forensic analyst investigating a Windows workstation that shows signs of malware infection. The user reports that the system is slow, network activity is high, and several files have been encrypted with a .encrypted extension. A ransom note named README.txt has been left on the desktop demanding payment. You have acquired a memory dump using FTK Imager and a disk image using dd. You need to identify the malware family and gather indicators of compromise (IOCs). Which of the following is the MOST appropriate first step?

Accepted Answer

Extract the ransom note and search for known ransomware identifiers such as Bitcoin wallet addresses or contact email.. The ransom note (README.txt) is a primary source of ransomware identifiers such as Bitcoin wallet addresses, contact emails, or Tor payment site URLs. Extracting these IOCs from the note allows you to quickly cross-reference known ransomware families (e.g., Ryuk, Maze, LockBit) via threat intelligence feeds, which is the most efficient first step in malware forensics before deeper analysis.

Answer

Run the malware sample in a sandbox environment to observe its behavior.

Answer

Perform static analysis of the encrypted files to determine the encryption algorithm used.

Answer

Immediately disconnect the system from the network and power it off to preserve evidence.

Question 8

Which email header field is MOST reliable for identifying the true origin of an email, assuming no header tampering occurred at the initial MTA?

Accepted Answer

Received. The 'Received' header is the most reliable for identifying the true origin of an email because each MTA that processes the message adds a new 'Received' header at the top, recording the IP address and timestamp of the previous hop. Assuming no tampering occurred at the initial MTA, the bottommost 'Received' header (the first added) contains the originating IP address of the sender's MTA or client, providing a direct trace back to the source.

Answer

Message-ID

Answer

From

Answer

DKIM-Signature

Question 9

A forensic lab is establishing a chain of custody procedure. Which practice is considered best according to CHFI guidelines?

Accepted Answer

Document every transfer of evidence with signatures and timestamps. The chain of custody is fundamentally a legal and procedural requirement to demonstrate the integrity and admissibility of digital evidence. CHFI guidelines emphasize that every transfer of evidence must be meticulously documented with signatures, timestamps, and purpose to create an unbroken audit trail, which is the only practice that directly satisfies the legal standard for evidence handling.

Answer

Require biometric authentication for all lab personnel

Answer

Store evidence in a secure room with limited access

Answer

Use encryption to protect evidence files

Question 10

During a forensic investigation, you find a file named ntuser.dat.LOG1 in a user's profile directory. What is the primary purpose of this file?

Accepted Answer

It logs changes to the user's registry hive for recovery purposes. The ntuser.dat.LOG1 file is a transactional log file used by the Windows registry to record changes made to the corresponding user's registry hive (ntuser.dat). Its primary purpose is to ensure data integrity and enable recovery of the hive in case of a system crash or power failure during a write operation, by allowing the registry to replay or roll back incomplete transactions.

Answer

It contains the user's Internet browsing history

Answer

It is a backup copy of the user's registry hive

Answer

It stores the user's recently accessed files

Question 11

In cloud forensics, which AWS service logs API calls for governance, compliance, and operational auditing, and is the primary source for detecting unauthorized access?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct answer because it is the dedicated AWS service that records all API calls made to the AWS environment, capturing details such as the identity of the caller, the time of the call, the source IP address, and the request parameters. This log data is essential for governance, compliance, and operational auditing, and it serves as the primary forensic source for detecting unauthorized access or suspicious activities by providing an immutable record of who did what and when.

Answer

AWS Config

Answer

Amazon CloudWatch

Answer

AWS GuardDuty

Question 12

An analyst discovers a suspicious file named 'cmd.aspx' in the uploads directory of an IIS web server. Analysis reveals the file contains code to execute system commands. What is this file most likely?

Accepted Answer

A web shell. A web shell is a malicious script uploaded to a web server (like IIS) that allows an attacker to execute arbitrary system commands through the web interface. The file 'cmd.aspx' is an ASP.NET page, and its ability to execute system commands is the hallmark of a web shell, often used for post-exploitation persistence and remote access.

Answer

A log file

Answer

A benign configuration file

Answer

A backup of a legitimate page

Question 13

Which of the following is the BEST definition of Locard's exchange principle in computer forensics?

Accepted Answer

Every contact leaves a trace; an attacker will leave digital traces on a system. Locard's exchange principle states that when a person interacts with a scene, they leave something behind and take something with them. In digital forensics, this means that an attacker will leave traces of their activity on the system (e.g., logs, malware) and may also remove evidence.

Answer

Chain of custody must be maintained to prove evidence integrity

Answer

The best evidence rule requires original evidence over copies

Answer

Digital evidence must be collected in a forensically sound manner to be admissible in court

Question 14

In Windows registry forensics, which registry hive contains the SAM database storing local user account hashes?

Accepted Answer

HKLM\Sam. The SAM (Security Account Manager) database, which stores local user account password hashes (LM and NTLM hashes), is mounted in the Windows registry under the HKLM\SAM hive. This hive is directly accessible only by the SYSTEM account for security reasons, and it contains the hashes in the SAM\SAM\Domains\Account\Users subkey. Option D is correct because HKLM\Sam is the exact registry path where the SAM database resides.

Answer

HKLM\Security

Answer

HKLM\System

Answer

NTUSER.DAT

Question 15

In Docker forensics, which of the following commands would you use to inspect the history of an image, including the commands that created each layer?

Accepted Answer

docker history. The `docker history` command displays the history of an image, showing each layer along with the command that created it. This is essential in forensic investigations to trace how an image was built, including any potentially malicious commands embedded in the layers.

Answer

docker image ls

Answer

docker logs

Answer

docker inspect