CHFI Practice Exam 2 — 20 Questions

Question 1

Which TWO of the following are indicators of a webshell on a web server? (Select TWO.)

Accepted Answer

The file contains system commands executed via GET or POST parameters. Webshells often have recent modification times out of sync with other files, and they typically accept command parameters in GET/POST requests. Large file size alone is not definitive, and missing index.html is unrelated.

Answer

A file named 'cmd.php' with a modification date matching other legitimate files

Answer

The server's index.html file is missing

Answer

The file is over 1 MB in size

Question 2

Which email header field is used to verify that an email was sent by the authorized mail server for the domain and has not been tampered with, using cryptographic signatures?

Accepted Answer

DKIM-Signature. DKIM (DomainKeys Identified Mail) uses a digital signature to verify the email's origin and integrity.

Answer

X-Mailer

Answer

Message-ID

Answer

Received-SPF

Question 3

During a network forensic investigation, the analyst recovers a PCAP file. What type of information can be directly extracted from this file?

Accepted Answer

Files transferred via HTTP. A PCAP file captures raw network packets. HTTP is an application-layer protocol that transmits data (e.g., files, web pages) in cleartext over TCP. By reassembling TCP streams from the captured packets, an analyst can directly extract files transferred via HTTP, as the payload contains the actual file content.

Answer

Operating system version of the source host

Answer

Registry data of the destination host

Answer

Disk partition table of the sending computer

Question 4

Locard's exchange principle is fundamental to forensic science. How does this principle apply to computer forensics?

Accepted Answer

Every action on a digital device leaves some trace of evidence.. Locard's principle states that every contact leaves a trace; in digital forensics, this translates to digital traces left behind when a system is accessed.

Answer

Digital evidence is always volatile and must be preserved immediately.

Answer

Evidence must be collected within 24 hours.

Answer

Only physical evidence, such as fingerprints, can be left at a crime scene.

Question 5

An IIS log entry shows: `2024-07-15 14:22:10 10.0.0.5 GET /../../windows/system32/cmd.exe 404 - Mozilla/5.0`. What attack technique does this log entry indicate?

Accepted Answer

Directory traversal. The presence of '../' sequences in the URI path indicates a path traversal attack attempting to access files outside the web root.

Answer

Remote code execution (RCE)

Answer

Cross-site request forgery (CSRF)

Answer

SQL injection

Question 6

A security analyst finds the following entry in the Apache access log: 10.0.0.5 - - [20/Jan/2023:08:12:44 +0000] "GET /../../../../etc/passwd HTTP/1.1" 404 345 "-" "curl/7.68.0". Which attack was attempted?

Accepted Answer

Path Traversal. The URI contains '../../../../etc/passwd', which is a path traversal attempt to read the /etc/passwd file. The 404 status indicates the file was not found, but the intent is clear.

Answer

Remote File Inclusion

Answer

Command Injection

Answer

Cross-Site Request Forgery (CSRF)

Question 7

A forensic analyst is investigating a MySQL database server breach. Which log is MOST useful for identifying a series of queries that exfiltrated data, assuming the attacker used a compromised application account?

Accepted Answer

General query log. MySQL general query log logs all queries, but can be resource-intensive. Binary logs record changes. Error logs contain errors. Slow query log logs slow queries. The general query log is best for seeing all queries from a compromised account.

Answer

Binary log

Answer

Slow query log

Answer

Error log

Question 8

A network analyst captures a packet with Wireshark showing a TCP SYN packet from IP 10.0.0.5 to 192.168.1.10 port 443, followed immediately by a SYN‑ACK from 192.168.1.10 to 10.0.0.5, then an RST from 10.0.0.5. What does this sequence MOST likely indicate?

Accepted Answer

A TCP SYN scan (stealth scan). A SYN followed by SYN‑ACK and then RST is typical of a port scan where the scanner sends a SYN, receives a SYN‑ACK (port open), and then immediately resets the connection to avoid completing the handshake.

Answer

A man‑in‑the‑middle attack

Answer

A denial‑of‑service (SYN flood) attack

Answer

A normal HTTPS session initiation

Question 9

A forensic investigator finds a suspicious file named `cmd.aspx` in the web root of a compromised IIS server. The file contains code that accepts command input via HTTP GET parameters and executes it on the server. What is the MOST likely classification of this file?

Accepted Answer

Web shell. A file that accepts commands via HTTP and executes them on the server is a web shell. ASPX is a common extension for .NET web shells.

Answer

Trojan horse

Answer

Cross-site scripting (XSS) exploit

Answer

SQL injection payload

Question 10

A security analyst is reviewing Apache access logs and finds repeated requests to /index.php?id=1' OR '1'='1. Which type of attack is MOST likely being attempted?

Accepted Answer

SQL injection. The pattern 1' OR '1'='1 is a classic SQL injection payload attempting to bypass authentication or extract data. The single quote and OR condition are characteristic of SQLi.

Answer

Remote file inclusion

Answer

Path traversal

Answer

Cross-site scripting (XSS)

Question 11

A security analyst runs a dynamic analysis of a suspected malware sample using Cuckoo Sandbox. The report shows that the sample created a mutex named 'Global\MyMaliciousMutex', added a registry run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, and attempted to communicate with an IP address 185.10.68.12 on port 443. Which of the following is the BEST immediate indicator of compromise (IoC) to share with the threat intelligence team?

Accepted Answer

The IP address 185.10.68.12. The IP address 185.10.68.12 on port 443 is the best immediate indicator of compromise (IoC) because it is a network-based artifact that can be directly blocked at the firewall or monitored for outbound connections. Network-based IoCs are often prioritized in threat intelligence sharing because they enable proactive perimeter defense and are actionable across multiple systems, unlike host-based artifacts (mutexes, registry keys) that require endpoint-level detection. Additionally, the IP address is independent of file hashes and can be used to detect or block communications even when the malware binary changes.

Answer

The registry run key location

Answer

The sample's MD5 hash

Answer

The mutex name 'Global\MyMaliciousMutex'

Question 12

Which of the following principles states that when two objects come into contact, there is a transfer of material between them?

Accepted Answer

Locard's exchange principle. Locard's exchange principle is a foundational concept in forensic science stating that whenever two objects come into contact, there is a transfer of material between them. In digital forensics, this principle applies to the transfer of digital artifacts (e.g., file fragments, metadata, network traces) when systems interact, such as when a suspect's device connects to a server or when data is copied between storage media.

Answer

The best evidence rule

Answer

The chain of custody

Answer

The hearsay rule

Question 13

A forensic analyst is creating a forensic image of a suspect's hard drive using a write blocker. Which of the following BEST describes the purpose of using a hardware write blocker?

Accepted Answer

To ensure that no data is written to the source drive during imaging. A hardware write blocker is a device placed between the suspect drive and the forensic workstation that intercepts and blocks any write commands from the operating system or imaging software. Its primary purpose is to guarantee that the source drive remains completely unaltered during acquisition, preserving the integrity of the evidence for legal and forensic purposes. This is achieved by allowing only read commands to pass through, while all write commands are physically or logically blocked at the hardware level.

Answer

To increase the speed of data acquisition

Answer

To encrypt the forensic image for secure storage

Answer

To allow the suspect drive to be booted without altering data

Question 14

According to Locard's exchange principle, which of the following is MOST relevant to digital forensics?

Accepted Answer

When a person interacts with a digital device, they leave digital traces that can be recovered. Locard's exchange principle states that every contact leaves a trace. In digital forensics, this translates to the fact that when a person interacts with a digital device (e.g., opening a file, browsing a website, or typing a command), they leave digital traces such as log entries, metadata, temporary files, or registry artifacts. These traces can be recovered and analyzed to reconstruct user activity, making option B the most relevant application of the principle in this context.

Answer

The chain of custody must be maintained for all evidence

Answer

Every crime scene contains at least one latent fingerprint

Answer

Digital evidence is always stored in non-volatile memory

Question 15

Which file system artifact in NTFS records file system events such as file creation, deletion, and modification, and is often used to track attacker activities?

Accepted Answer

USN Journal. The USN (Update Sequence Number) Journal is a native NTFS feature that logs all changes to files and directories on a volume, including creation, deletion, and modification events. Forensic analysts use it to reconstruct timelines of attacker activity because it records the reason for the change (e.g., USN_REASON_FILE_CREATE, USN_REASON_FILE_DELETE) along with timestamps and file references, even if the file is later deleted or renamed.

Answer

Event Logs

Answer

Prefetch files

Answer

Registry

Question 16

A forensic investigator uses the 'dd' command to create a forensic image. The original drive has a SHA-256 hash of a1b2c3... and the image produces the same hash. Which rule of evidence does this satisfy?

Accepted Answer

Authenticity. The SHA-256 hash of the original drive matches the hash of the forensic image, proving that the image is an exact, unaltered copy of the original. This satisfies the rule of authenticity, which requires that evidence be shown to be the same as what was originally seized and not tampered with. The hash acts as a digital fingerprint, and matching hashes confirm the integrity and origin of the evidence.

Answer

Reliability

Answer

Completeness

Answer

Admissibility

Question 17

A first responder arrives at a scene where a computer is suspected to contain evidence of fraud. The computer is turned on and a file is open. Which of the following actions should the responder AVOID?

Accepted Answer

Double-clicking the open file to fully view its contents.. Double-clicking the open file alters its last accessed timestamp and may modify file metadata (e.g., NTFS $STANDARD_INFORMATION or $FILE_NAME attributes), potentially destroying volatile evidence. It also risks executing malicious code or changing the file's content if the application auto-saves. The first responder must preserve the current state and capture a forensic image before any interaction with active data.

Answer

Photographing the screen and documenting open windows.

Answer

Noting the time and date from the system clock.

Answer

Using a hardware write blocker to image the hard drive after shutdown.

Question 18

A forensic investigator examines a hard drive and needs to recover deleted files. Which tool is specifically designed for file carving by scanning raw data for file headers and footers without relying on the file system?

Accepted Answer

Foremost. Foremost is a file carving tool that scans raw disk data for known file headers and footers (e.g., JPEG, PDF, ZIP) to recover files independently of the file system metadata. This makes it ideal when the file system is damaged or deleted, as it relies solely on content signatures rather than directory structures.

Answer

Volatility

Answer

Autopsy

Answer

FTK Imager

Question 19

An analyst finds evidence that an attacker used steganography to hide data within image files on the suspect's computer. Which of the following tools is MOST appropriate for detecting steganography in these images?

Accepted Answer

Stegdetect. Stegdetect is specifically designed to detect steganographic content in images by analyzing statistical anomalies in pixel data, such as those introduced by LSB (Least Significant Bit) embedding. It can identify common steganography tools like JSteg, JPHide, and OutGuess, making it the most appropriate choice for this scenario.

Answer

Foremost

Answer

Autopsy

Answer

Volatility

Question 20

During a forensic examination of a Windows system, an analyst runs the Volatility plugin `netscan` on a memory dump. What information does this plugin primarily provide?

Accepted Answer

Network connections and listening sockets with associated processes. The Volatility plugin `netscan` is specifically designed to extract network connection information from Windows memory dumps, including active TCP and UDP connections, listening sockets, and the associated processes that own them. It works by scanning kernel data structures such as `_TCPT_OBJECT` and `_UDP_OBJECT` to provide a snapshot of network activity at the time of capture, which is critical for identifying malicious connections or unauthorized services.

Answer

Open files and handles for each process

Answer

List of all running processes and their parent processes

Answer

The contents of the Windows firewall rules