CHFI Practice Exam 4 — 20 Questions

Question 1

Refer to the exhibit. An investigator runs the queries on an Oracle database during a live forensic acquisition. What does the output indicate about the database transaction state?

Accepted Answer

Exactly one transaction is currently active. The query `SELECT COUNT(*) FROM v$transaction;` returns a count of 1, which indicates that exactly one transaction is currently active in the Oracle database. The `v$transaction` view shows only uncommitted or unrolled-back transactions; a committed transaction is removed from this view. Therefore, the output confirms that one transaction is active and has not yet been committed or rolled back.

Answer

The transaction has been rolled back

Answer

The transaction has been committed

Answer

No transactions are currently active

Question 2

Match each network protocol to its well-known port number (TCP/UDP).

Question 3

Match each email forensic artifact to its source.

Question 4

Which of the following best describes the 'Best Evidence Rule' as it applies to digital evidence?

Accepted Answer

A forensic image is considered the best evidence if the original is unavailable. The Best Evidence Rule requires that the original evidence be presented, but in digital forensics, a forensic image is considered the best evidence if the original is not practical.

Answer

Hearsay evidence is admissible if it is the only evidence available

Answer

The original digital media must be presented in court

Answer

Oral testimony is always better than written records

Question 5

Drag and drop the steps to perform a forensic analysis of email headers to trace the origin of a spam email into the correct order.

Question 6

Drag and drop the steps to perform a forensic analysis of a PDF file for hidden data or malicious content into the correct order.

Question 7

Drag and drop the steps to perform a forensic analysis of a USB drive to identify the connected computer using Windows artifacts into the correct order.

Question 8

Drag and drop the steps to perform forensic imaging of a hard drive using FTK Imager into the correct order.

Question 9

Match each forensic artifact to its location in Windows (typical).

Question 10

Match each file system to its typical maximum volume size (as commonly encountered).

Question 11

Match each file carving technique to its description.

Question 12

Match each Windows Registry hive to its stored information.

Question 13

Match each steganography technique to its carrier medium.

Question 14

Match each forensic acquisition method to its description.

Question 15

Match each log type to its typical content.

Question 16

During the initial response to a suspected data breach, a first responder discovers a live system with active network connections. The responder needs to preserve evidence while minimizing alteration. Which of the following is the MOST appropriate first step?

Accepted Answer

Use a memory acquisition tool to capture the contents of RAM.. A is correct because in a live system with active network connections, the most volatile evidence is in RAM (e.g., running processes, network connections, encryption keys). Using a memory acquisition tool (like FTK Imager or WinPmem) captures this volatile data before any other action, preserving evidence that would be lost on shutdown or disconnection. This aligns with the order of volatility (RFC 3227), which prioritizes memory over disk.

Answer

Run a full disk imaging tool to capture the hard drive contents.

Answer

Disconnect the network cable to isolate the system from the network.

Answer

Immediately shut down the system by pulling the power cord.

Question 17

A forensic lab manager is setting up a new lab and must decide on the physical security measures. Which of the following is the MOST important to implement first?

Accepted Answer

Implement a biometric access control system. Biometric access control is the most critical first step because it establishes a foundational layer of physical security that authenticates and authorizes personnel before they can access the lab. Without controlling who enters, other measures like CCTV or fire suppression are less effective, as unauthorized individuals could compromise evidence integrity. This aligns with the principle of defense-in-depth, where access control is the primary barrier against tampering or theft.

Answer

Construct Faraday cages around the evidence storage area

Answer

Deploy CCTV cameras covering all entry points

Answer

Install a gas-based fire suppression system

Question 18

What is the primary goal of computer forensics?

Accepted Answer

To identify, preserve, analyze, and present digital evidence in a legally acceptable manner. Computer forensics aims to preserve evidence in its most original form, identify the root cause of an incident, and document the investigation for legal proceedings.

Answer

To prosecute cybercriminals

Answer

To recover deleted files for data recovery

Answer

To secure the network from future attacks

Question 19

During a mobile forensic investigation of an iPhone, the examiner extracts data using a physical acquisition method. Which of the following BEST describes the level of data recovery achieved by this method?

Accepted Answer

It creates a bit-for-bit copy of the entire flash memory, including deleted files and unallocated space. Physical acquisition creates a bit-for-bit copy of the entire flash memory, including deleted files and unallocated space, providing the most complete data recovery.

Answer

It recovers the file system but not deleted files

Answer

It extracts data via the user interface by manually interacting with the device

Answer

It recovers only logical files visible to the operating system

Question 20

During a mobile forensic investigation, an analyst uses Cellebrite UFED to extract data from a locked iOS device. The extraction successfully retrieves the device's passcode, call logs, SMS messages, and application data. Which extraction method did the analyst MOST likely use?

Accepted Answer

Advanced logical extraction. C is correct because Advanced Logical Extraction (ALE) on Cellebrite UFED leverages a combination of file system parsing, agent-based extraction, and exploit techniques to retrieve the device passcode, call logs, SMS messages, and application data from a locked iOS device without requiring a full physical dump. This method bypasses the logical extraction limitations by using a custom agent or AFC (Apple File Conduit) to access protected data, making it the most likely method for the described successful extraction.

Answer

File system extraction

Answer

Physical extraction

Answer

Logical extraction

CHFI Practice Exam 4 — 20 Questions

Exhibit

CHFI Practice Exam 4 — 20 Questions

Exhibit