CHFI Practice Exam 3 — 20 Questions

Question 1

A forensic analyst is examining a PostgreSQL database server that was compromised. The attacker gained superuser access and deleted several rows from a critical table. The database is configured with WAL (Write-Ahead Log) archiving. Which method would allow the analyst to identify the exact time the deletions occurred?

Accepted Answer

Use the pg_waldump utility to parse the WAL files and identify DELETE operations with timestamps.. D is correct because `pg_waldump` is the PostgreSQL utility specifically designed to parse Write-Ahead Log (WAL) files and display their contents in a human-readable format, including the exact timestamps and operation types (e.g., DELETE). Since the database uses WAL archiving, the archived WAL segments will contain a record of every data modification, allowing the analyst to pinpoint when the deletions occurred.

Answer

Review the pg_stat_activity view to see the history of queries executed.

Answer

Examine the archive_status directory to find the timestamp of the WAL file that contains the deletion.

Answer

Query the pg_audit table to retrieve a log of all DELETE statements.

Question 2

During a malware investigation, an analyst discovers a suspicious file with a hash value that matches known malware. However, the file fails to execute and does not exhibit any malicious behavior in a sandbox. What is the most likely reason for this discrepancy?

Accepted Answer

The file is packed or obfuscated to prevent execution in a sandbox. Option D is correct because malware authors often use packing or obfuscation techniques to prevent the malicious payload from executing in an analysis environment. The packed code requires a specific unpacking routine or trigger (e.g., a specific system call, registry key, or timing condition) that the sandbox does not provide, causing the file to appear inert. This is a common anti-sandbox technique distinct from simple signature evasion.

Answer

The file is a false positive and is actually benign

Answer

The sandbox is not updated with the latest signatures

Answer

The file's metadata has been modified to evade analysis

Question 3

Which THREE of the following are best practices for conducting malware forensics in a safe and effective manner?

Accepted Answer

Use a dedicated forensic workstation that is not connected to any network. Option A is correct because a dedicated forensic workstation that is not connected to any network prevents the malware from communicating with command-and-control (C2) servers, exfiltrating data, or spreading to other systems. This isolation ensures the integrity of the analysis environment and protects the broader infrastructure from accidental infection or data leakage.

Answer

Delete the malware sample after analysis to prevent accidental infection

Answer

Run all analysis using the same tools and versions as the attacker

Question 4

An organization suspects a stealthy malware infection on a critical server. Traditional antivirus and EDR solutions have not detected anything. Which forensic approach would be most effective in identifying the malware, given that it likely resides only in memory?

Accepted Answer

Acquire a memory dump and perform memory forensics with tools like Volatility. Option B is correct because the malware resides only in memory, making it invisible to disk-based scans. Memory forensics with tools like Volatility allows investigators to analyze RAM artifacts (e.g., processes, network connections, injected code) to detect stealthy malware that never writes to disk.

Answer

Perform a full disk scan with updated antivirus signatures

Answer

Conduct a live analysis using built-in Windows tools like Task Manager

Answer

Analyze network traffic for anomalies using a NetFlow analyzer

Question 5

Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?

Accepted Answer

It is a virtual directory that contains files with no parent directory, often from deleted files. In The Sleuth Kit (TSK), the 'fls' command lists files and directories within a disk image. The entry 'V/V 113-128-1: $OrphanFiles' is a virtual directory that contains files that have no parent directory in the file system, typically because their directory entries were deleted or corrupted. This is a common artifact when recovering deleted files from NTFS volumes, as TSK collects such orphaned MFT entries into this virtual container.

Answer

It is a sign that a rootkit has hidden files in the image

Answer

It indicates the location of the Master File Table (MFT) mirror

Answer

It is a standard NTFS metadata file that stores file permissions

Question 6

A security analyst is tasked with reverse engineering a suspected malware sample. Which initial step should the analyst take to ensure safe handling and prevent accidental infection?

Accepted Answer

Create a bit-for-bit forensic image of the sample. Creating a bit-for-bit forensic image (option A) is the correct first step because it preserves the malware in an immutable, write-protected state, preventing any accidental execution or modification. This ensures the integrity of the evidence and allows the analyst to work with a safe copy without risking infection of the host system or network. In malware forensics, this aligns with the fundamental principle of maintaining a chain of custody and avoiding alteration of the original sample.

Answer

Execute the sample in a debugger on a production machine

Answer

Disassemble the binary using IDA Pro directly

Answer

Connect the sample to an isolated network to observe behavior

Question 7

During malware analysis, an investigator finds that a suspicious process is injecting code into a legitimate system process (e.g., explorer.exe). Which technique is being used?

Accepted Answer

Code injection. Code injection is the correct answer because the scenario describes a process injecting arbitrary code into a legitimate system process like explorer.exe. This is the generic term for techniques where malicious code is written into the address space of another process and executed, often via Windows API calls such as WriteProcessMemory and CreateRemoteThread. The question explicitly states 'injecting code,' which directly maps to the broad category of code injection, not a specific subtype.

Answer

API hooking

Answer

Process hollowing

Answer

DLL injection

Question 8

Which TWO of the following are common indicators of a rootkit infection on a Windows system?

Accepted Answer

System calls returning inconsistent results. Option B is correct because rootkits operate at the kernel level, intercepting system calls to hide their presence. When a system call (e.g., NtQuerySystemInformation) is invoked, the rootkit modifies the return data to exclude malicious processes or files, causing the results to be inconsistent with the actual system state. This is a classic symptom of a kernel-mode rootkit that has hooked the System Service Dispatch Table (SSDT).

Answer

High CPU usage by svchost.exe

Answer

Unexpected open ports on the firewall

Answer

Presence of unsigned kernel drivers

Question 9

Drag and drop the steps to perform a forensic examination of a mobile device (Android) using Cellebrite UFED into the correct order.

Question 10

Drag and drop the steps to conduct a memory acquisition using DumpIt on a Windows system into the correct order.

Question 11

Drag and drop the steps to capture network traffic with Wireshark for forensic analysis into the correct order.

Question 12

Drag and drop the steps to perform a forensic analysis of a Windows registry using RegRipper into the correct order.

Question 13

Drag and drop the steps to recover deleted files using Recuva into the correct order.

Question 14

Drag and drop the steps to create a forensic timeline using the Sleuth Kit (TSK) and log2timeline into the correct order.

Question 15

During a forensic investigation, an analyst needs to preserve the integrity of evidence on a hard drive. Which of the following is the best practice for acquiring an image of the drive?

Accepted Answer

Use a hardware write blocker and create a bit-stream image.. Option C is correct because using a hardware write blocker ensures that no write commands from the forensic workstation reach the suspect drive, preserving its integrity at the physical level. Creating a bit-stream image (sector-by-sector copy) captures all data, including slack space and unallocated clusters, which is essential for thorough forensic analysis. This combination is the gold standard in digital forensics, as mandated by best practices like those from NIST and the ACPO principles.

Answer

Use the 'dd' command to create a raw image without a write blocker.

Answer

Connect the drive to a forensic workstation and use the operating system's copy command.

Answer

Format the drive before imaging to ensure no hidden data is missed.

Question 16

Refer to the exhibit. A forensic examiner is analyzing a Windows system and sees the above NTFS file metadata. The user claims the file was last accessed at 09:15. Which of the following best explains the discrepancy?

Accepted Answer

The $UsnJrnl entry shows the file was modified, and the last access time was updated by the system when the file was opened for reading. Option A is correct because the $UsnJrnl (Update Sequence Number Journal) records that the file was modified, and on Windows systems, when a file is opened for reading, the last access time is updated by default. The discrepancy arises because the user claims the file was last accessed at 09:15, but the NTFS metadata shows a different last access time, which could be due to the system updating the last access time upon modification or read operations, as recorded in the $UsnJrnl.

Answer

The system has disabled last access time updates, so the reported times are unreliable

Answer

The creation time is earlier than the last access, indicating the file was copied from another volume

Answer

The $LogFile sequence number indicates a transaction rollback that reset the timestamps

Question 17

A cloud forensic analyst is tasked with preserving evidence from an AWS S3 bucket that may contain malicious files. The bucket is publicly accessible, and the analyst wants to create a forensically sound copy. Which method BEST ensures integrity and chain of custody?

Accepted Answer

Use the AWS CLI sync command with the --checksum-mode flag to verify integrity during transfer.. Option D is correct because the AWS CLI `sync` command with the `--checksum-mode` flag automatically computes and compares checksums (e.g., SHA256) during the transfer, ensuring data integrity without manual intervention. This method also preserves metadata and timestamps, which is critical for maintaining a forensically sound copy and chain of custody in cloud forensics.

Answer

Download each object via the AWS Management Console and compute SHA256 hashes manually.

Answer

Use the AWS CLI cp command recursively without any flags.

Answer

Generate a presigned URL for the bucket and use wget to download all files.

Question 18

During a forensic investigation of a cloud environment, a forensic analyst discovers that the virtual machine (VM) used by a suspect was terminated three days prior. The cloud provider offers snapshots, backups, and instance metadata. Which of the following is the BEST course of action to recover forensic evidence?

Accepted Answer

Restore the VM from a recent snapshot or backup provided by the cloud provider.. Option D is correct because once a VM is terminated, its underlying instance store or ephemeral disks are destroyed, but persistent snapshots and backups retain the disk state at the time they were taken. Restoring from a recent snapshot or backup is the only reliable method to recover the VM's file system, application data, and user artifacts for forensic analysis in a cloud environment.

Answer

Examine CloudTrail logs for disk contents.

Answer

Access the VM’s operating system via the cloud console’s serial console.

Answer

Use SSH credentials from the investigation to connect to the terminated instance.

Question 19

Which TWO of the following are valid locations in a Windows system where forensic evidence of USB device connection can be found?

Accepted Answer

SYSTEM\CurrentControlSet\Enum\USBSTOR registry key. The SYSTEM\CurrentControlSet\Enum\USBSTOR registry key is a primary location where Windows records every USB storage device that has been connected to the system. Each device is listed under this key with a unique instance ID, including the vendor ID, product ID, and serial number, providing persistent evidence of USB connections even after the device is removed.

Answer

Amcache.hve file

Answer

Event Logs with source 'Device Setup'

Answer

C:\Windows\Prefetch folder

Question 20

A forensic investigator needs to capture network traffic from a SPAN port on a switch to analyze an ongoing compromise. Which tool should the investigator use to collect the full packet capture (pcap) for later analysis?

Accepted Answer

tcpdump. tcpdump is a command-line packet capture utility that captures raw network traffic at the link layer, making it ideal for collecting full packet captures (PCAP) from a SPAN port. Unlike GUI tools, it can run headless on a forensic workstation and write binary PCAP files for later analysis with tools like Wireshark. It captures all packets traversing the SPAN port without filtering by default, ensuring a complete record of the compromise.

Answer

NetFlow

Answer

nmap

Answer

Wireshark