CHFI Practice Test 14 — 15 Questions

Question 1

During a forensic investigation, you need to acquire the RAM of a running Linux system. Which tool is specifically designed for memory acquisition on Linux?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is the correct tool because it is specifically designed to capture volatile memory (RAM) from Linux systems, loading as a loadable kernel module (LKM) to dump memory contents to a file or over the network. Unlike generic tools, LiME handles kernel address space layout randomization (KASLR) and can acquire memory without altering the system state, making it the standard for Linux forensic memory acquisition.

Answer

Memdump

Answer

Volatility

Answer

WinPmem

Question 2

Based on the acquisition log, what can be concluded about the integrity of the acquired image?

Accepted Answer

The image is an exact copy of the source. The acquisition log shows that the hash values computed for the source drive and the acquired image match exactly. A matching hash (e.g., MD5 or SHA-1) verifies that the image is a bit-for-bit identical copy of the original evidence, confirming forensic soundness. Therefore, the image is an exact copy of the source, making option D correct.

Answer

The image is not forensically sound because the verification passed

Answer

The source and image have different data

Answer

The image is corrupted because only one hash algorithm was used

Question 3

During an investigation of a suspected data exfiltration, a forensic analyst examines MySQL general query logs and finds a large number of SELECT queries retrieving customer records, followed by DELETE queries. Which of the following is the most likely conclusion?

Accepted Answer

An attacker exfiltrating data and then deleting the records to cover tracks. The combination of bulk SELECT (exfiltration) followed by DELETE (cover tracks) is a classic pattern of data theft.

Answer

An attempted SQL injection attack

Answer

A misconfigured replication process

Answer

Normal database maintenance operations

Question 4

In a cloud forensic investigation, the analyst needs to obtain a memory dump of a virtual machine. Which method is considered forensically sound?

Accepted Answer

Take a snapshot of the VM via the hypervisor and export the .vmem file. Forensically sound because taking a snapshot of the VM via the hypervisor and exporting the .vmem file captures the entire volatile memory state from outside the guest OS, without altering any data inside the VM. This method preserves the memory in its pristine state and avoids the contamination that occurs when executing tools inside the suspect VM.

Answer

Log into the VM and use a tool to create a crash dump

Answer

Copy the virtual disk file (.vmdk) and extract memory from it

Answer

Use a live forensic tool inside the VM to capture memory

Question 5

During a forensic investigation of a MongoDB database, the analyst needs to identify which user executed a particular write operation. Which MongoDB log or feature should the analyst examine?

Accepted Answer

Audit log (auditLog). The audit log (auditLog) is the correct source because it is specifically designed to record user authentication and database operations, including which user executed a write operation. MongoDB's audit system captures detailed events such as insert, update, and delete commands along with the authenticated user identity, making it the definitive forensic artifact for user attribution.

Answer

Journal (journal directory)

Answer

System log (mongod.log)

Answer

Oplog (local.oplog.rs)

Question 6

Which TWO of the following are requirements for evidence to be admissible in court? (Select two.)

Accepted Answer

Evidence must be reliable. The rules of evidence require that evidence be admissible, reliable, complete, and authentic. In many jurisdictions, evidence must be relevant and reliable to be admissible. Completeness and authenticity are also key.

Answer

Evidence must be encrypted

Answer

Evidence must be stored on a write-blocked drive

Answer

Evidence must be obtained by the police

Question 7

A security analyst is reviewing Windows Security Event Logs and notices multiple Event ID 4625 entries for a single user account within a short time frame. What does this MOST likely indicate?

Accepted Answer

Brute-force password guessing attack. Event ID 4625 indicates a failed logon attempt. Multiple failures in a short time suggest a brute-force attack against the user account.

Answer

Service installation

Answer

Account lockout policy change

Answer

Successful account logon

Question 8

A forensic analyst is examining a hard drive that was imaged using a software write blocker. Which of the following is a potential disadvantage of using a software write blocker compared to a hardware write blocker?

Accepted Answer

It may be susceptible to operating system or driver vulnerabilities. A software write blocker operates at the operating system level, intercepting write commands before they reach the storage device. Because it relies on the OS and its drivers, any vulnerability in the OS kernel, storage driver stack, or the blocker's own filter driver could be exploited, potentially allowing unintended writes to the evidence. In contrast, a hardware write blocker physically prevents write signals from reaching the drive at the bus level, offering a more robust isolation that is independent of the host OS's security state.

Answer

It cannot be used with USB drives

Answer

It does not support hashing algorithms for integrity

Answer

It is more expensive than hardware write blockers

Question 9

In the context of e-discovery, what does the 'best evidence rule' require regarding digital documents?

Accepted Answer

That the original electronic file or a reliable duplicate be produced.. The best evidence rule, codified in Federal Rule of Evidence 1002, requires the original writing, recording, or photograph to prove its content unless otherwise provided. In e-discovery, an original electronic file or a reliable duplicate (e.g., a bit-for-bit forensic image verified by a hash such as MD5 or SHA-1) satisfies this rule because the duplicate is functionally equivalent to the original for evidentiary purposes.

Answer

That all evidence be authenticated by a witness.

Answer

That only paper copies of digital documents are admissible.

Answer

That metadata is preserved in all copies.

Question 10

Which of the following is the BEST definition of computer forensics?

Accepted Answer

The application of investigative and analytical techniques to gather and preserve evidence from digital devices suitable for presentation in a court of law.. Computer forensics is fundamentally the application of investigative and analytical techniques to collect, preserve, and analyze digital evidence in a manner that maintains its integrity and admissibility in a court of law. This definition encompasses the entire forensic process, from acquisition through chain of custody to presentation, aligning with the CHFI framework's emphasis on legal and procedural rigor.

Answer

The use of software tools to scan for malware on a computer system.

Answer

The process of recovering deleted files from a hard drive.

Answer

The process of securing a computer network from unauthorized access.

Question 11

During an investigation, an analyst uses `dd if=/dev/sdb of=evidence.img bs=4k conv=noerror,sync`. What is the purpose of the `conv=noerror,sync` option?

Accepted Answer

It skips read errors and pads the output with zeros to maintain block alignment.. The `conv=noerror,sync` option in `dd` instructs the tool to continue processing even when a read error is encountered (`noerror`) and to pad the output block with zeros (`sync`) to maintain the original block alignment. This ensures that the resulting image file remains the same size as the source device, preserving the forensic integrity of the data layout despite hardware-level read failures.

Answer

It hashes each block to verify integrity.

Answer

It enables synchronous writing to ensure data integrity.

Answer

It compresses the output image to save space.

Question 12

In cloud forensics, which AWS service provides a centralized log of API calls made by users and services, often used to investigate unauthorized access or configuration changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls for governance, compliance, and operational auditing, making it essential for forensic investigations in AWS.

Answer

AWS CloudWatch

Answer

AWS Config

Answer

AWS VPC Flow Logs

Question 13

A security team needs to preserve network evidence for a potential legal case. What is the BEST practice for capturing volatile network data?

Accepted Answer

Perform packet capture using a portable tool and store the capture with a cryptographic hash. Capturing volatile network data requires immediate acquisition of live traffic before it is lost, and using a portable tool (e.g., tcpdump, Wireshark) allows rapid deployment. Storing the capture with a cryptographic hash (e.g., SHA-256) ensures data integrity and chain of custody, which is essential for admissibility in legal proceedings. This approach preserves the most volatile evidence (packet contents) while providing verifiable proof that the data has not been altered.

Answer

Wait until normal business hours to capture traffic

Answer

Only record summary logs from the firewall

Answer

Use a dedicated forensic workstation with a write blocker

Question 14

An analyst finds the following in an IIS log: 10.0.0.5, -, 02/15/2024, 14:23:56, GET /../../windows/system32/cmd.exe, 404, 0, 0, 0, Mozilla/4.0. Which attack technique does this log entry represent?

Accepted Answer

Path traversal. The URI contains ../ patterns attempting to access a system file outside the web root, which is path traversal.

Answer

Cross-site scripting

Answer

SQL injection

Answer

Remote code execution

Question 15

Which TWO of the following are valid email header fields that can be used to detect email spoofing? (Select 2)

Accepted Answer

Received-SPF. SPF and DKIM are email authentication mechanisms that help detect spoofing. SPF checks if the sending server is authorized, DKIM verifies the email integrity.

Answer

Subject

Answer

Content-Type

Answer

MIME-Version