CHFI Practice Test 16 — 15 Questions

Question 1

A forensic analyst is examining a Windows 10 system for evidence of USB device usage. Which registry hive and key path should she check to find a list of USB devices that have been connected to the system?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum stores the device instance IDs and class GUIDs for every USB mass storage device that has ever been connected to the system. This is the primary forensic artifact for enumerating historical USB device attachments on Windows 10.

Answer

HKLM\SAM\SAM\Domains\Account\Users

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

NTUSER.DAT\Software\Microsoft\Windows\ShellNoRoam\BagMRU

Question 2

An incident responder receives an alert that a workstation is beaconing to a known malicious IP address. The responder captures network traffic and analyzes it with Wireshark. Which of the following would be an immediate indicator of compromise (IoC) visible in the traffic capture?

Accepted Answer

Repeated connections to a known malicious IP address on a non-standard port. Repeated connections to a known malicious IP address on a non-standard port directly match the definition of a beaconing indicator of compromise (IoC). In network traffic analysis, beaconing is characterized by periodic, outbound connections to a command-and-control (C2) server, often using a non-standard port to evade detection. This pattern is a primary IoC in malware forensics and is immediately visible in Wireshark as a series of TCP SYN packets to the same IP and port at regular intervals.

Answer

Large file transfers during off-hours

Answer

ARP requests from unknown MAC addresses

Answer

Encrypted payloads using TLS 1.3

Question 3

A security analyst arrives at a suspected computer crime scene. The computer is on and a user is logged in. The analyst needs to preserve volatile data. According to first responder duties, what should the analyst do FIRST?

Accepted Answer

Capture volatile data such as running processes and network connections. The first responder's priority is to preserve volatile data, which is lost when the system is powered off. Volatile data includes running processes, network connections, and memory contents, which must be captured before any other action. This aligns with the order of volatility (RFC 3227) and standard forensic procedures.

Answer

Immediately unplug the power cord to prevent data alteration

Answer

Create a forensic image of the hard drive using a write blocker

Answer

Photograph the scene and document everything

Question 4

An expert witness is preparing to testify in a computer forensics case. Which of the following is a key requirement for the expert's testimony to be admissible under the Daubert standard?

Accepted Answer

The expert's techniques must be based on reliable principles and methods. Under the Daubert standard, the admissibility of expert testimony hinges on whether the expert's techniques are based on reliable principles and methods, not merely on general acceptance. This standard, established in Daubert v. Merrell Dow Pharmaceuticals, requires the trial judge to act as a gatekeeper, evaluating the scientific validity and reliability of the methodology used. In computer forensics, this means the expert must demonstrate that their acquisition, preservation, and analysis methods (e.g., using write-blockers, cryptographic hashing like SHA-256, and chain-of-custody documentation) are scientifically sound and consistently applied.

Answer

The expert's methods must be generally accepted in the scientific community

Answer

The expert must have personally examined all evidence

Answer

The expert must have a law degree

Question 5

Which TWO of the following are common hashing algorithms used to verify the integrity of forensic images? (Select two.)

Accepted Answer

SHA-1. SHA-1 (B) is a cryptographic hash function that produces a 160-bit digest and is widely used in forensic imaging tools to verify that a disk image has not been altered, making it correct here. MD5 (E) is likewise a common hashing algorithm producing a 128-bit digest, and it is routinely paired with SHA-1 to validate the integrity of forensic images, so it is also correct. AES (A) is a symmetric block cipher used for encryption, not a hashing algorithm, so it does not verify integrity. Blowfish (C) is also a symmetric encryption cipher, not a hash function. RSA (D) is an asymmetric public-key algorithm used for encryption and digital signatures, not for generating integrity hashes.

Answer

AES

Answer

Blowfish

Answer

RSA

Question 6

A forensic analyst is examining a malware sample that uses packing to obfuscate its code. Which static analysis tool is BEST suited to identify the packer used and potentially unpack the executable?

Accepted Answer

PEiD. PEiD (Portable Executable Identifier) is specifically designed to detect packers, cryptors, and compilers used in PE files by scanning for known signatures in the executable's entry point. It is the best static analysis tool for identifying the packer and can often unpack the executable using its built-in generic unpacker or by invoking the packer's own unpacking stub. This makes it ideal for the initial triage of packed malware samples.

Answer

Cuckoo Sandbox

Answer

Ghidra

Answer

IDA Pro

Question 7

Which of the following BEST describes the chain of custody in digital forensics?

Accepted Answer

A log of all personnel who have accessed the evidence, along with timestamps and reasons.. The chain of custody is a documented chronological record that tracks the seizure, custody, control, transfer, analysis, and disposition of digital evidence. It must include every person who handled the evidence, the date and time it was accessed, the purpose of access, and any changes made, ensuring the evidence's integrity and admissibility in court under rules like Federal Rule of Evidence 901.

Answer

The software tool used to image the hard drive.

Answer

The process of encrypting evidence to prevent unauthorized access.

Answer

The physical lock and key used to secure the evidence locker.

Question 8

Which Azure log source should an investigator query to identify who deleted a virtual machine and when?

Accepted Answer

Azure Activity Log. The Azure Activity Log (formerly known as Audit Logs) is the subscription-level log that records all control-plane operations on Azure resources, including virtual machine creation, deletion, and modification. When a VM is deleted, the Activity Log captures the operation name (e.g., 'Microsoft.Compute/virtualMachines/delete'), the caller's identity (user or service principal), the timestamp, and the status of the operation. This makes it the authoritative source for answering 'who deleted a VM and when'.

Answer

Azure Active Directory sign-in logs

Answer

Azure Diagnostic Settings for the VM

Answer

Network Security Group flow logs

Question 9

Which TWO of the following are essential steps that a first responder should take when arriving at a digital crime scene? (Select TWO)

Accepted Answer

Capture volatile data from running systems. Option A is correct because volatile data such as RAM contents, running processes, network connections, and open files will be lost on shutdown or reboot, so a first responder must capture it using tools like memory dumps or live-response utilities before powering down the system. Option E is correct because photographing and documenting the scene preserves the original state and chain of custody, recording the physical layout, cable connections, and system status before any evidence is altered. Option B is not an essential first-responder step because forensic imaging is typically performed later by a forensic examiner after volatile data is secured and the scene is documented, and imaging a running system prematurely can destroy volatile evidence. Option C is wrong because installing software on the suspect's computer modifies the system and contaminates evidence, violating the principle of least intrusion. Option D is wrong because witness interviews must be documented to maintain an accurate and admissible record; undocumented interviews are unreliable and not an essential first-responder action.

Answer

Immediately start the forensic imaging process

Answer

Install forensic software on the suspect's computer

Answer

Interview all witnesses without documentation

Question 10

Which TWO tools are specifically designed for file carving (recovering files based on signatures) and are commonly used in digital forensics?

Accepted Answer

Scalpel. Scalpel (B) is correct because it is a signature-based file carving tool derived from Foremost that reads a configurable header/footer database to extract files from raw disk images or unallocated space without relying on filesystem metadata. Foremost (C) is correct because it was originally developed for the U.S. Air Force OSI and carves files by matching file headers and footers (e.g., JPEG, PDF, ZIP) in disk images, making it a canonical carving utility in digital forensics. Volatility (A) is a memory forensics framework for analyzing RAM dumps, not a file carver. EnCase (D) is a full commercial forensic suite that can recover files via filesystem parsing and some carving, but it is not specifically designed as a signature-based carving tool. Autopsy (E) is a graphical forensic platform that integrates carving modules (often via Scalpel or its own ingest modules) but is not itself a dedicated carving tool.

Answer

Volatility

Answer

EnCase

Answer

Autopsy

Question 11

Which TWO of the following are primary purposes of using the GrayKey tool in iOS forensics?

Accepted Answer

Extract the full file system from a locked iOS device. Option C is correct because GrayKey is a hardware-based forensic tool designed to perform full file system extractions from iOS devices, including locked ones, providing investigators with a complete image of the device's data rather than just a logical backup. Option D is correct because a core function of GrayKey is passcode bypass — it uses brute-force and exploit techniques to defeat the iOS lock screen passcode, which is the prerequisite that enables the full file system extraction in option C. Options A and B are incorrect because GrayKey is not a static malware analysis platform nor a binary decryption tool; those tasks are handled by disassemblers and reverse-engineering suites such as IDA Pro, Ghidra, or Hopper. Option E is incorrect because GrayKey does not create encrypted iTunes backups — that is the function of iTunes/Finder or libimobiledevice, and GrayKey's purpose is direct device extraction, not backup generation.

Answer

Perform static analysis of iOS malware

Answer

Decrypt iOS application binaries for analysis

Answer

Create an encrypted iTunes backup

Question 12

A forensic analyst is examining an Android device using ADB extraction. Which TWO statements about ADB extraction are true?

Accepted Answer

ADB extraction requires USB debugging to be enabled on the device. Option A is correct because ADB (Android Debug Bridge) communication over USB is only possible when the device has USB debugging enabled in Developer Options; without it, the adb daemon on the host cannot establish a session with the device. Option E is correct because, once USB debugging is on, the device presents an RSA key fingerprint prompt and the host must be authorized (the device stores the host's public key in adb_keys); an unauthorized host is rejected, so the analyst must accept the prompt or pre-provision the key. Option B is wrong because non-rooted ADB access is confined to the shell user's permissions and cannot read protected app data or system partitions. Option C is wrong because ADB extraction is a logical acquisition (e.g., adb pull, adb backup) and cannot produce a bit-for-bit physical image of the flash storage. Option D is wrong because deleted files in unallocated space are only recoverable from a physical image or raw flash dump, not through ADB's logical file-level access.

Answer

ADB extraction allows full file system access without root

Answer

ADB extraction can acquire a physical image of the device

Answer

ADB extraction can recover deleted files from unallocated space

Question 13

An Android forensic examiner performs a physical acquisition on a device. Which TWO of the following are typical artefacts that can be recovered from the /data/data/ directory on a non-rooted device if the acquisition method allows full file system access?

Accepted Answer

App-specific SQLite databases. Option D is correct because /data/data// is the private sandbox for each installed app, and apps commonly store their structured data in SQLite databases (e.g., /data/data/com.example.app/databases/*.db), which a full file-system acquisition can recover. Option E is correct because Android apps persist key-value settings in SharedPreferences, stored as XML files under /data/data//shared_prefs/*.xml, which are likewise recoverable with full file-system access. Options A, B, and C are not typical artefacts of /data/data/: bootloader configuration resides in bootloader/partition areas (e.g., /misc, /bootloader), recovery mode logs are produced by the recovery partition and typically stored in /cache/recovery/, and kernel logs come from the kernel ring buffer accessed via dmesg or /proc/kmsg, not from the app data directory.

Answer

Bootloader configuration

Answer

Recovery mode logs

Answer

Kernel logs

Question 14

During dynamic analysis of a malware sample in a sandbox, an analyst observes the following behaviours: (1) A file is created at C:\Windows\System32\drivers\etc\hosts, (2) A registry key is set at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateSvc, (3) Outbound TCP connections to 198.51.100.10 on port 8080. Which THREE of the following IoCs are MOST relevant to share with the threat intelligence team?

Accepted Answer

Network connection to 198.51.100.10:8080. The outbound TCP connection to 198.51.100.10 on port 8080 is a direct network-based indicator of compromise (IoC) that threat intelligence teams can use to block or monitor malicious C2 traffic. This IP and port combination represents a specific command-and-control endpoint, making it highly actionable for network defense and threat hunting.

Answer

MD5 hash of the original malware file

Answer

Mutex name created by the malware

Question 15

A security analyst observes a process making repeated network connections to an IP address 192.168.1.100 on TCP port 4444, and the process writes a DLL file to C:\Users\Public\. Which THREE actions should the analyst take immediately as part of dynamic analysis?

Accepted Answer

Isolate the host from the network to prevent further C2 communication. Option A is correct because the repeated TCP connections to 192.168.1.100 on port 4444 strongly indicate command-and-control (C2) traffic, and isolating the host from the network immediately contains the incident and prevents further data exfiltration or remote instructions. Option B is correct because capturing a memory dump with FTK Imager (or an equivalent tool like WinPmem or DumpIt) preserves volatile evidence such as injected code, running processes, network connections, and encryption keys that would be lost on shutdown or reboot. Option D is correct because Process Monitor (Procmon) provides real-time visibility into process creation, file system writes (such as the DLL dropped in C:\Users\Public\), registry changes, and network activity, which is essential for dynamic analysis of the malware's behavior. Option C is not appropriate because deleting the DLL destroys forensic evidence and may not stop the running process, which could simply re-drop the file; the analyst should preserve and analyze it first. Option E is not appropriate at this stage because reimaging the hard drive destroys all volatile and non-volatile evidence needed for dynamic and forensic analysis, and should only occur after evidence collection and containment.

Answer

Delete the DLL file to stop the malware

Answer

Reimage the hard drive to remove the malware