CHFI Practice Test 22 — 15 Questions

Question 1

An analyst is examining a hard drive that was seized from a suspect. The drive is detected as a smaller capacity than listed on the label. Which of the following is the MOST likely explanation?

Accepted Answer

The drive has a Host Protected Area (HPA) that hides sectors from the OS. A Host Protected Area (HPA) is a reserved region on an ATA/ATAPI hard drive that can hide sectors from the operating system, making the drive appear smaller than its physical capacity. This is a common anti-forensics technique used to conceal data, and it can be detected and removed using tools like hdparm or ATA Security commands.

Answer

The drive has been partitioned with a GPT table, which does not use the full capacity

Answer

The file system is FAT32, which has a 2 TB limit

Answer

The drive controller has a firmware bug reporting incorrect size

Question 2

A forensic investigator is examining a Linux system compromised via a web application. Which THREE artifacts should the investigator prioritize to determine the attacker's entry point and post-exploitation activities?

Accepted Answer

/home/compromised_user/.bash_history. Option A, /home/compromised_user/.bash_history, is correct because the shell history file records the exact commands the attacker typed after gaining access, directly revealing post-exploitation activities such as reconnaissance, privilege escalation attempts, and persistence commands. Option C, /var/log/auth.log, is correct because it captures authentication events including sudo usage, su attempts, SSH logins, and PAM failures, which help establish how the attacker escalated privileges or moved laterally after the initial web compromise. Option E, web server access logs (e.g., /var/log/apache2/access.log), is correct because they record HTTP requests with source IPs, URIs, and status codes, allowing the investigator to identify the malicious request that exploited the web application and thus the entry point. Option B, /etc/shadow, is not a priority artifact here because it only stores password hashes and does not by itself show attacker activity or entry vectors. Option D, cron job entries in /etc/crontab, is not among the top three because while cron can indicate persistence, it is less directly tied to identifying the entry point and immediate post-exploitation actions than the history, auth, and access logs.

Answer

/etc/shadow

Answer

Cron job entries in /etc/crontab

Question 3

Which THREE of the following are best practices for a first responder when arriving at a computer crime scene?

Accepted Answer

Photograph the entire scene, including the computer screen and connections. Option A is correct because photographing the entire scene—including the screen contents, cable connections, and peripheral devices—creates an accurate, tamper-evident visual record of the original state before anything is touched, which is essential for later legal admissibility. Option B is correct because disconnecting the computer from the network (e.g., unplugging the Ethernet cable or disabling Wi-Fi) prevents remote tampering, malware propagation, or remote wipe commands while preserving the local system state. Option E is correct because volatile data such as RAM contents, running processes, network connections, and open files are lost on shutdown, so a first responder should capture this evidence first using accepted order-of-volatility principles. Option C is not appropriate because powering off the machine destroys volatile evidence and can trigger encryption or anti-forensic routines, and it contradicts the need to preserve RAM. Option D is not appropriate for a first responder because booting from a forensic CD alters the system state and is a later laboratory or examiner step, not an initial scene-response action.

Answer

Turn off the computer immediately to prevent remote access

Answer

Boot the computer from a forensic CD to preview the hard drive

Question 4

A security analyst reviews Windows Security Event Log and finds multiple Event ID 4625 entries for a single user account within a few seconds. What does this pattern MOST likely indicate?

Accepted Answer

Brute-force password attack. Event ID 4625 is a Windows Security log event that records failed logon attempts. When multiple 4625 events appear for the same user account within a few seconds, it indicates a high volume of authentication failures in a short time window, which is the classic signature of a brute-force password attack. The rapid succession of failures rules out accidental mistypes and points to an automated or manual attempt to guess the password.

Answer

Service installation

Answer

Account creation

Answer

Successful logon by the user

Question 5

During a forensic analysis of a Linux system, the investigator finds that the bash_history file is empty for the root user. However, the system has been used actively. What is the MOST likely explanation?

Accepted Answer

The HISTSIZE environment variable is set to 0 or the history file is redirected to /dev/null. The HISTSIZE environment variable controls how many commands are retained in memory during a session. When set to 0, no commands are stored, and the history file (typically ~/.bash_history) remains empty. Alternatively, if HISTFILE is redirected to /dev/null, all history writes are discarded, explaining the empty file despite active use.

Answer

The system was shut down improperly

Answer

The file is corrupted

Answer

The user deleted the history

Question 6

An incident responder finds a suspicious LNK file in a user's Startup folder on a Windows system. The LNK file's target is "C:\Windows\System32\rundll32.exe" with a command-line argument "javascript:" followed by encoded text. What is the most likely purpose of this shortcut?

Accepted Answer

A malicious persistence mechanism to execute payload via script. The LNK file targets rundll32.exe with a JavaScript command-line argument, which is a known technique for executing arbitrary script code without writing a traditional executable to disk. This is commonly used by malware to establish persistence by placing the shortcut in the Startup folder, ensuring the script runs each time the user logs in.

Answer

A shortcut to a network resource that failed

Answer

Legitimate update mechanism for Microsoft Office

Answer

A user-created automation script for daily tasks

Question 7

A network analyst is reviewing a packet capture and sees a large number of TCP SYN packets sent to various ports on a single host from multiple source IPs. This pattern is most indicative of which type of attack?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets with spoofed source IPs to a target host. The target allocates resources for each half-open connection, exhausting its backlog queue and preventing legitimate connections. The pattern of many SYN packets from multiple IPs to various ports matches this attack's signature.

Answer

ARP spoofing

Answer

DNS amplification

Answer

Ping of death

Question 8

An investigator is analyzing an Android device and finds a database file in /data/data/com.whatsapp/databases/msgstore.db. Which type of information is MOST likely stored in this database?

Accepted Answer

WhatsApp chat messages. The msgstore.db file in the WhatsApp package directory is the primary SQLite database that stores all WhatsApp chat messages, including text messages, media metadata, and message timestamps. This database is located at /data/data/com.whatsapp/databases/msgstore.db on Android devices and is a key artifact for forensic recovery of WhatsApp conversations.

Answer

System call logs

Answer

GPS location history

Answer

Contact list from the device

Question 9

A forensic analyst is examining a network intrusion detection system (NIDS) alert that triggered on a packet with the FIN, PSH, and URG flags set. What type of scan does this indicate?

Accepted Answer

Xmas scan. A is correct because an Xmas scan sends packets with the FIN, PSH, and URG flags set (like a Christmas tree lit up). According to RFC 793, a closed port must respond with an RST packet, while an open port should drop the packet silently (no response). The NIDS alert triggered on these three flags together, which is the signature of an Xmas scan.

Answer

NULL scan

Answer

SYN scan

Answer

ACK scan

Question 10

Based on the log exhibit, what type of attack is occurring?

Accepted Answer

Brute-force attack on SSH. The log shows multiple failed SSH login attempts from the same IP address with different usernames and passwords, which is characteristic of a brute-force attack targeting SSH. The repeated 'Failed password' entries for various user accounts (e.g., root, admin, user) indicate an automated attempt to guess credentials, not a single successful compromise or a different attack type.

Answer

Man-in-the-middle attack

Answer

SQL injection attack

Answer

Denial of Service attack

Question 11

An investigator examines an iPhone backup file. Inside the backup manifest, they find a file path 'AppDomainGroup-group.com.example.app'. This indicates the data belongs to which type of app container?

Accepted Answer

A shared container for multiple apps from the same developer. The file path 'AppDomainGroup-group.com.example.app' indicates a shared container used by App Groups, a feature that allows multiple apps from the same developer to share data. This is not a sandbox container for a single app, nor is it a system or temporary container. The 'group' prefix and the bundle identifier pattern confirm it belongs to a shared app group container.

Answer

System container for iOS system apps

Answer

The app's sandbox container

Answer

Temporary container for app data

Question 12

Which Windows Event ID is generated when a new service is installed on the system?

Accepted Answer

7045. Windows Event ID 7045 is specifically logged in the System event log when a new service is installed on the system. This event records the service name, image path, service type, and start mode, making it a critical artifact for forensic investigators tracking unauthorized service installations or persistence mechanisms.

Answer

4648

Answer

4720

Answer

4624

Question 13

In a corporate investigation, legal counsel issues a litigation hold to preserve electronically stored information (ESI) relevant to a lawsuit. Which of the following is the BEST description of a litigation hold?

Accepted Answer

A notice to employees to preserve all relevant ESI and cease routine deletion.. A litigation hold is a legal notice issued to employees and data custodians instructing them to preserve all relevant electronically stored information (ESI) and to suspend any routine deletion, archiving, or destruction policies. This ensures that potentially discoverable data remains intact and unaltered for the duration of the legal proceeding, directly supporting the duty to preserve evidence under the Federal Rules of Civil Procedure (FRCP Rule 37(e)).

Answer

A form of encryption used to protect evidence during transport.

Answer

A technique used to acquire forensic images without altering the source.

Answer

A court order authorizing law enforcement to seize computers.

Question 14

A security analyst reviews Windows Event Logs and sees Event ID 4625 multiple times for a single user account from a remote IP address within a short time frame. What is the MOST likely interpretation?

Accepted Answer

An attacker is attempting to brute-force the user's password. Event ID 4625 indicates a failed logon attempt. Multiple occurrences for the same user from a single remote IP within a short timeframe is the classic signature of a brute-force attack, where an attacker systematically tries different passwords against that account.

Answer

The user successfully logged on from multiple locations

Answer

The system is experiencing a denial-of-service attack

Answer

A service installed itself on the system

Question 15

In static malware analysis, what is the purpose of using a tool like PEiD?

Accepted Answer

To detect packers or compilers used in the PE file. PEiD is a static analysis tool that identifies packers, cryptors, and compilers embedded in Portable Executable (PE) files by scanning for known signatures in the file's entry point and section headers. This helps an analyst understand whether the malware is packed (obfuscated) and what tool was used to create or compress it, which is critical before attempting dynamic analysis or unpacking.

Answer

To monitor registry changes during execution

Answer

To disassemble the binary into assembly code

Answer

To analyze network traffic generated by the malware