CHFI Practice Test 13 — 15 Questions

Question 1

A security analyst is investigating a containerized application running on a Docker host. The analyst needs to collect forensic evidence from a stopped container without starting it. Which of the following Docker commands should be used to export the container's filesystem as a tar archive?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

docker export. The `docker export` command creates a tar archive of a container's filesystem, even if the container is stopped, without starting it. This is the correct tool for extracting forensic evidence from a stopped container's filesystem as a single archive file.

Answer

docker commit

Answer

docker cp

Answer

docker save

Question 2

Which tool is specifically designed for parsing and analyzing email headers to trace the origin of an email and detect spoofing?

Accepted Answer

EmailTrackerPro. EmailTrackerPro is specifically designed to parse email headers, extract routing information, and trace the path an email took from sender to recipient. It analyzes fields like Received, Message-ID, and Authentication-Results to detect spoofing, forging, or relay anomalies, making it the correct tool for this task.

Answer

Wireshark

Answer

EnCase

Answer

Nmap

Question 3

A Linux investigator wants to see all commands run by a user from the bash shell. Which file should be examined?

Accepted Answer

~/.bash_history. The ~/.bash_history file stores the command history for each user's bash shell session. When a user runs commands in bash, they are appended to this file (typically in the user's home directory) unless history logging is disabled. Examining this file allows an investigator to see the exact commands executed by that specific user from the bash shell.

Answer

/etc/passwd

Answer

/var/log/auth.log

Answer

/var/log/syslog

Question 4

Which cloud forensic challenge refers to the inability to physically access the storage media where data resides?

Accepted Answer

Lack of physical access. Cloud forensics often involves data stored on remote servers managed by a cloud service provider (CSP). Forensic investigators cannot physically seize or access the hard drives or SSDs due to the CSP's infrastructure and security policies, making physical access impossible. This lack of physical access is a fundamental challenge that distinguishes cloud forensics from traditional digital forensics, where the media can be physically acquired and imaged.

Answer

Data jurisdiction

Answer

Multi-tenancy

Answer

Volatility of evidence

Question 5

A web server log shows the following request: 'GET /../../../../etc/passwd HTTP/1.1' with a 200 response code. The web server is running Apache on Linux. What attack has likely succeeded?

Accepted Answer

Local File Inclusion (LFI) or Path Traversal. The request 'GET /../../../../etc/passwd HTTP/1.1' with a 200 response indicates the server successfully returned the contents of the /etc/passwd file. This is a classic path traversal attack (also known as Local File Inclusion) where the attacker uses '../' sequences to escape the web root directory and access arbitrary files on the Linux filesystem. Apache's default configuration does not block such sequences if directory traversal protections are missing, allowing the attacker to read sensitive system files.

Answer

Remote File Inclusion (RFI)

Answer

SQL injection

Answer

Cross-Site Request Forgery (CSRF)

Question 6

Which Linux log file is the primary source for authentication-related events, including SSH login attempts and sudo usage?

Accepted Answer

/var/log/auth.log. /var/log/auth.log is the dedicated Linux log file for authentication-related events, including SSH login attempts (via PAM and sshd), sudo usage, and user authentication failures. This file is managed by the syslog daemon and is the primary source for forensic analysis of authentication activity on Debian-based systems.

Answer

/var/log/kern.log

Answer

/var/log/syslog

Answer

/var/log/messages

Question 7

In a Google Cloud Platform (GCP) environment, a forensic investigator needs to determine who deleted a Cloud Storage bucket and when. Which log type should be queried to obtain this information?

Accepted Answer

Cloud Audit Logs (Admin Activity). Cloud Audit Logs (Admin Activity) in GCP record all API calls that modify the configuration or metadata of resources, including the deletion of a Cloud Storage bucket. These logs capture the identity of the principal who performed the action, the timestamp, and the specific operation (e.g., `storage.buckets.delete`), making them the authoritative source for answering who deleted a bucket and when.

Answer

Cloud Monitoring metrics

Answer

VPC flow logs

Answer

Cloud Storage access logs

Question 8

An incident responder is analyzing a compromised web server and finds a file named 'cmd.aspx' in the uploads directory. The file contains ASP.NET code that accepts commands via the 'cmd' parameter and executes them on the server. Which of the following best describes this artifact?

Accepted Answer

A webshell allowing remote command execution. The file 'cmd.aspx' is an ASP.NET webshell that accepts commands via the 'cmd' parameter and executes them server-side. This is a classic indicator of a webshell, which provides remote command execution (RCE) capabilities to an attacker, not a legitimate administrative tool.

Answer

A legitimate administrative tool for server management

Answer

A backdoor installed via a SQL injection vulnerability

Answer

A malware dropper for deploying ransomware

Question 9

An organization uses Azure. A security analyst needs to investigate a suspicious login event. Which Azure log contains details about user sign-ins, including IP address, timestamp, and success/failure status?

Accepted Answer

Azure AD Sign-in logs. Microsoft Entra ID Sign-in logs (Option B) are the correct source because they specifically capture user authentication events, including the IP address of the client, the exact timestamp of the sign-in attempt, and the success or failure status (e.g., 'Success', 'Failure', 'Interrupted'). This log is part of Microsoft Entra ID's monitoring suite and is designed for identity-related forensic investigations, unlike infrastructure or resource-level logs.

Answer

Azure Monitor Metrics

Answer

Azure Activity Logs

Answer

Azure Security Center alerts

Question 10

A security analyst reviews an Apache access log entry: 192.168.1.5 - - [10/Jan/2024:08:12:35 +0000] "GET /index.php?id=1 UNION SELECT username,password FROM users-- HTTP/1.1" 200 4321 "-" "Mozilla/5.0". What type of attack is MOST likely indicated?

Accepted Answer

SQL injection. The log entry shows a UNION SELECT statement appended to the id parameter, which is a classic SQL injection attempt.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Remote file inclusion

Question 11

Which THREE of the following are challenges specific to container forensics? (Select THREE.)

Accepted Answer

Containers share the same kernel as the host, limiting isolation for forensic acquisition. Containers are ephemeral (volatile evidence), they share the host kernel (limited isolation), and they rely on layered images that must be analyzed. Standard disk imaging tools may not work; network isolation is not a specific challenge.

Answer

Network isolation prevents packet capture

Answer

Standard forensic imaging tools can be directly applied

Question 12

Which of the following is an example of Locard's Exchange Principle as applied to digital forensics?

Accepted Answer

A suspect's computer contains log files showing they accessed a server. Locard's Exchange Principle states that every contact leaves a trace. In digital forensics, this translates to the idea that when a system interacts with another, digital artifacts (such as log entries, registry keys, or network connection records) are created. Option A is correct because the log files on the suspect's computer are a direct trace of the contact between the suspect's system and the server, demonstrating the principle in a digital context.

Answer

A hard drive is encrypted and cannot be read

Answer

A firewall blocks all incoming traffic from a specific IP address

Answer

A write blocker prevents data from being written to a drive

Question 13

A cloud forensic investigator is analyzing a GCP audit log entry for a Compute Engine instance. Which THREE fields are essential for identifying the user and operation performed?

Accepted Answer

methodName. GCP audit logs include the principal email (authenticationInfo), operation type (methodName), and resource name (resourceName). IP address and user agent may be in requestMetadata but not always in every log entry.

Answer

requestMetadata.callerIp

Answer

requestMetadata.userAgent

Question 14

Which of the following tools is specifically designed to analyze email headers and track the path of an email, providing information about delays and potential spoofing?

Accepted Answer

EmailTracker. EmailTracker is a tool that analyzes email headers, visualizes the path, and helps identify spoofing and delivery delays.

Answer

Wireshark

Answer

FTK Imager

Answer

Autopsy

Question 15

A forensic lab is designing a network architecture to ensure the integrity of evidence during acquisition. What is the most critical design consideration?

Accepted Answer

Implement hardware write-blockers on all acquisition stations. Hardware write-blockers are the most critical design consideration because they physically prevent any write operations to the source drive at the ATA/SCSI command level, ensuring that the evidence remains bit-for-bit unchanged during acquisition. Without a hardware write-blocker, even a single read operation from a forensic workstation could inadvertently modify metadata (e.g., last access timestamps) or trigger anti-forensic mechanisms, compromising the integrity of the evidence and its admissibility in court.

Answer

Deploy multiple forensic workstations to parallelize tasks

Answer

Use a segmented network to isolate forensic tools

Answer

Encrypt all data in transit over the network