CHFI Practice Test 2 — 10 Questions

Question 1

During a cloud forensic investigation, an analyst needs to identify who deleted an S3 bucket in an AWS environment. Which AWS service log should the analyst examine to find the API call and the associated IAM user or role?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made to AWS services, including S3 bucket deletion, along with the identity of the caller.

Answer

Amazon S3 server access logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 2

A forensic investigator is analyzing a compromised web server. In the Apache access logs, the investigator finds the following request: 'GET /images/../../../etc/passwd HTTP/1.1' with a 200 status code. Which of the following is the MOST likely reason the server returned a 200 (OK) response?

Accepted Answer

The server is vulnerable to directory traversal and returned the contents of /etc/passwd. A 200 response to a path traversal request indicates that the server executed the request and returned the file content, meaning the directory traversal attack succeeded.

Answer

The server redirected the request to the root directory and returned the index page

Answer

The server has a custom 404 page that returns a 200 status code

Answer

The request was blocked by a web application firewall (WAF) which returned a 200 status

Question 3

A security analyst reviewing Apache access logs finds entries like: 192.168.1.10 - - [12/Jan/2023:15:23:11 +0000] "GET /search?q=1' OR '1'='1 HTTP/1.1" 200 5324. What attack is indicated?

Accepted Answer

SQL injection. The log entry shows a SQL injection attempt via the 'q' parameter with a tautology. The 200 response indicates the request was processed, suggesting possible success.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Command injection

Question 4

A CHFI analyst is called to investigate a suspected data breach. The IT team has already shut down the server. Which of the following is the most appropriate order of actions to preserve evidence?

Accepted Answer

Secure the scene, photograph the setup, document connections, remove hard drives, and create forensic images using a write-blocker.. It follows the established forensic investigation process: secure the scene to prevent contamination, document the state of the server (photographs and connection diagrams), then physically remove the hard drives and create forensic images using a write-blocker to preserve the original data without alteration. This ensures evidence integrity and admissibility in legal proceedings.

Answer

Immediately power on the server to check for running processes.

Answer

Copy all files from the server to an external USB drive.

Answer

Run antivirus scan to ensure no malware is present before imaging.

Question 5

Which of the following BEST defines the chain of custody in digital forensics?

Accepted Answer

The chronological documentation of evidence handling, transfer, and analysis. The chain of custody is a formal, chronological record that documents every instance of evidence handling, transfer, and analysis from the moment of seizure through its entire lifecycle. This documentation is critical to prove that evidence has not been tampered with, altered, or corrupted, thereby maintaining its admissibility in legal proceedings under rules such as Federal Rule of Evidence 901.

Answer

The legal authority required to seize evidence

Answer

The order in which forensic tools are applied to evidence

Answer

The physical security measures used to store evidence

Question 6

An email forensic investigator examines a suspicious email and notices the following header: Received: from mail.evil.com (192.168.1.100) by mail.company.com. The DKIM-Signature header fails verification. What does this indicate?

Accepted Answer

The email may be spoofed or its content altered. A failing DKIM-Signature indicates the email may have been tampered with during transit or was not signed by the claimed domain. This is a strong indicator of email spoofing or alteration.

Answer

The receiving server rejected the email

Answer

The email is legitimate and was forwarded through a relay

Answer

The email was sent from a compromised mail server

Question 7

An investigator needs to testify in court as an expert witness. Which of the following qualifications is MOST important for the court to accept their testimony?

Accepted Answer

They can demonstrate knowledge, skill, experience, training, or education that will assist the trier of fact.. Under the Federal Rules of Evidence (FRE) Rule 702, a witness qualified as an expert by knowledge, skill, experience, training, or education may testify if their specialized knowledge will assist the trier of fact. Option C directly mirrors this legal standard, making it the most critical qualification for admissibility. Certifications, publications, or years of service are supporting factors but not independently sufficient under the Daubert or Frye standards.

Answer

They have a certification in computer forensics.

Answer

They have published articles in peer-reviewed journals on digital forensics.

Answer

They have been employed as a forensic analyst for over 10 years.

Question 8

What is the primary goal of computer forensics?

Accepted Answer

To preserve and analyze digital evidence in a legally admissible manner. The primary goal of computer forensics is to preserve and analyze digital evidence in a manner that is legally admissible in court.

Answer

To prevent future cyber attacks

Answer

To identify and prosecute cybercriminals

Answer

To recover deleted files from a hard drive

Question 9

During a cloud forensics investigation of an AWS environment, an analyst extracts CloudTrail logs and notices many events with the error code 'AccessDenied' for a specific IAM user attempting to list an S3 bucket. Which of the following is the most appropriate next step?

Accepted Answer

Review the IAM policies attached to the user to determine if the action was authorized. AccessDenied indicates the user lacks permissions; check IAM policies to see if the user should have access or if it's an unauthorized attempt.

Answer

Immediately disable the IAM user account

Answer

Escalate the issue to law enforcement

Answer

Check the S3 bucket's access logs for the same IP address

Question 10

A forensic analyst is testifying as an expert witness in court. The opposing counsel challenges the analyst's testimony based on the Frye standard. What does the Frye standard require for scientific evidence to be admissible?

Accepted Answer

The evidence must be based on techniques generally accepted in the scientific community.. The Frye standard requires that scientific evidence be based on principles and methods that are generally accepted by the relevant scientific community.

Answer

The evidence must have been obtained with a warrant.

Answer

The evidence must be relevant and more probative than prejudicial.

Answer

The evidence must have been peer-reviewed and published.