CHFI Practice Test 23 — 15 Questions

Question 1

An analyst identifies an unknown binary running on a Linux server. Which /proc filesystem entry would provide the command-line arguments used to start the process?

Accepted Answer

/proc/[pid]/cmdline. /proc/[pid]/cmdline contains the exact command-line arguments used to start the process, stored as null-separated strings. This allows an analyst to see how the binary was invoked, including any flags or parameters, which is critical for identifying malicious or suspicious behavior.

Answer

/proc/[pid]/maps

Answer

/proc/[pid]/status

Answer

/proc/[pid]/environ

Question 2

In Windows forensics, which artifact is used to track recently executed programs on a per-user basis?

Accepted Answer

UserAssist. UserAssist is a Windows registry key (under NTUSER.DAT) that records the execution count and last execution time of GUI-based programs for each user. It is specifically designed to track recently executed programs on a per-user basis, making it the correct artifact for this forensic question.

Answer

Jump lists

Answer

ShellBags

Answer

Prefetch files

Question 3

A forensic analyst is examining a Windows system and finds a prefetch file named NOTEPAD.EXE-12345678.pf. What information can be gleaned from this artifact? (Select the BEST answer.)

Accepted Answer

It records the application's execution count and last run time. Prefetch files in Windows are designed to speed up application startup by caching information about the files loaded during the first few seconds of execution. The filename includes the application name and a hash of the file path, while the internal metadata records the execution count and last run time, making option C correct.

Answer

It saves a copy of the application's configuration

Answer

It logs all network connections made by the application

Answer

The file contains the user's password for the application

Question 4

Which TWO of the following are valid methods to collect logs from Docker containers for forensic analysis? (Select TWO)

Accepted Answer

Using docker logs command to retrieve container logs. Option A is correct because the `docker logs` command retrieves the stdout/stderr output captured by the container's configured logging driver (e.g., json-file, journald), which is the primary source of application logs for forensic review. Option C is correct because `docker cp` allows an investigator to copy log files written inside the container's filesystem (e.g., /var/log/app.log) to the host for offline analysis, which is essential when logs are not sent to stdout/stderr. Option B is not a collection method; `docker inspect` only reveals the logging driver and configuration (such as LogPath), not the log contents themselves. Option D is not a valid collection method because running syslog inside the container starts a new logging service rather than extracting existing container logs. Option E is incorrect because `docker image` inspects image layers and metadata, which contain no runtime container logs.

Answer

Using docker inspect to get log configuration

Answer

Using docker exec to run syslog inside the container

Answer

Using docker image to view the image layers

Question 5

Which Windows Registry hive contains user-specific configuration such as MRU lists and UserAssist artifacts?

Accepted Answer

NTUSER.DAT. The NTUSER.DAT file is the registry hive that stores per-user configuration settings, including MRU (Most Recently Used) lists and UserAssist artifacts. When a user logs into a Windows system, this hive is loaded into HKEY_CURRENT_USER (HKCU), making it the primary source for user-specific forensic artifacts such as executed program traces and file access history.

Answer

HKLM\SAM

Answer

SYSTEM

Answer

HKLM\System

Question 6

Which Windows Event ID is generated when a service is installed on a system?

Accepted Answer

7045. Event ID 7045 is logged in the Windows System event log when a new service is installed on the system. This event records the service name, image path, service type, and start mode, making it a critical artifact for forensic investigators tracking unauthorized service installations.

Answer

4624

Answer

4688

Answer

4720

Question 7

Which tool is specifically designed for dynamic analysis of malware by executing it in a controlled, isolated environment and logging its behavior?

Accepted Answer

Cuckoo Sandbox. Cuckoo Sandbox is the correct answer because it is an open-source automated malware analysis system specifically designed to execute suspicious files in a controlled, isolated environment (a sandbox) and log their behavior, including system calls, file system changes, network traffic, and memory dumps. Unlike static analysis tools, Cuckoo performs dynamic analysis by actually running the malware and observing its runtime actions.

Answer

PEiD

Answer

IDA Pro

Answer

Ghidra

Question 8

An analyst is investigating a Linux system that used ext4. The suspect deleted several files and then ran 'fstrim' on the partition. Which of the following best describes the challenge in recovering the deleted data?

Accepted Answer

The TRIM command instructs the SSD to permanently erase the blocks, and wear leveling may also have moved data. D is correct because the `fstrim` command sends the ATA TRIM (or SCSI UNMAP) command to the SSD, which instructs the drive to physically erase the blocks that are marked as free in the file system. This makes the original data unrecoverable at the block level, as the SSD's firmware permanently discards the data. Additionally, wear leveling may have already moved the data to different physical blocks before the TRIM command, further complicating recovery.

Answer

The ext4 journal will automatically purge the metadata of deleted files

Answer

Data recovery is still possible using file carving because fstrim only affects free space

Answer

The inodes are overwritten immediately, making recovery impossible

Question 9

During an investigation of a compromised system, the analyst discovers that the suspect used steganography to hide data within image files. Which forensic tool is BEST suited for detecting hidden data in images through statistical analysis?

Accepted Answer

Stegdetect. Stegdetect is specifically designed to detect hidden data in images by applying statistical analysis to identify anomalies in pixel distributions that indicate steganographic embedding. It uses techniques like chi-square analysis and RS analysis to detect LSB (Least Significant Bit) steganography, making it the best choice for this task.

Answer

Binwalk

Answer

Wireshark

Answer

Foremost

Question 10

A forensic analyst is examining a Windows system and finds that the UserAssist key in the NTUSER.DAT hive contains entries with Rot13-encoded names. What is the primary purpose of the UserAssist key?

Accepted Answer

Log program execution counts and last run times. The UserAssist key in the NTUSER.DAT hive is designed to track program execution counts and the last time each program was run by the user. The Rot13 encoding of the subkey names is a lightweight obfuscation to hide the logged application paths, but the core purpose remains forensic artifact for user activity timeline reconstruction.

Answer

Record USB device connection history

Answer

Store user password history

Answer

Track recently opened documents via Jump Lists

Question 11

A network forensic investigator is analyzing traffic from a compromised web server. Which TWO artifacts are MOST likely to indicate the presence of a web shell? (Select TWO.)

Accepted Answer

Presence of a suspicious .aspx or .php file in web directories. Option C is correct because web shells are typically deployed as malicious script files (e.g., .aspx, .php, .jsp) placed in web-accessible directories, so finding an unexpected or suspicious script file there is a strong indicator of a web shell. Option D is correct because web shells are commonly invoked through HTTP POST requests to unusual or non-standard script paths, allowing attackers to send commands and receive output over the web channel. Options A, B, and E are not the most likely indicators: DNS queries to external domains, excessive SYN-ACK packets, and high ICMP traffic can reflect other activities such as command-and-control, scanning, or tunneling, but they are not specific artifacts of a web shell on a compromised web server.

Answer

Multiple DNS queries to external domains

Answer

Excessive SYN-ACK packets

Answer

High volume of ICMP traffic

Question 12

A forensic examiner is analyzing a compromised Linux server and notices that /etc/cron.daily contains a script named 'sysupdate.sh' that runs a base64-encoded command. Which persistence mechanism is being used?

Accepted Answer

Cron job for daily execution. The presence of a script named 'sysupdate.sh' inside /etc/cron.daily indicates that the system's cron daemon is configured to execute this script once per day. Cron jobs are a standard Linux persistence mechanism, and placing a script in /etc/cron.daily ensures it runs automatically on a daily schedule, making option B correct.

Answer

LD_PRELOAD library injection

Answer

Systemd service

Answer

SSH authorized_keys backdoor

Question 13

Which TWO of the following are examples of circumstantial evidence in a digital forensics investigation? (Select TWO)

Accepted Answer

Metadata showing a file was created on the suspect's computer during the incident timeframe. Option C is correct because file metadata (such as MAC times — Modified, Accessed, Created/Changed timestamps) is generated automatically by the file system and does not directly prove the suspect performed the criminal act; it only supports an inference that the file was created on the suspect's machine during the incident window, which is the essence of circumstantial evidence. Option E is correct because server logs recording the suspect's IP address at the time of the incident are system-generated artifacts that, by themselves, only suggest a connection between the suspect's address and the event; they require inference (and corroboration, since IP addresses can be spoofed or shared via NAT) to link the suspect to the crime, making them circumstantial. Option A is not circumstantial but direct testimonial evidence, since the witness claims firsthand observation of the crime. Option B is direct evidence because the recording itself shows the suspect performing the incriminating act of typing the password. Option D is direct evidence as a signed confession is an admission by the suspect of the act itself, not an inferential link.

Answer

A witness testifying they saw the suspect commit the crime

Answer

A video recording of the suspect typing a password

Answer

A signed confession from the suspect

Question 14

Which TWO of the following are challenges specific to SSD forensics compared to HDD forensics?

Accepted Answer

Wear leveling distributes writes, complicating data location. Option A is correct because SSD controllers use wear leveling to spread writes across flash blocks, so logical block addresses no longer map predictably to physical NAND locations, making it hard to determine where data actually resides. Option E is correct because the ATA TRIM command (and SCSI UNMAP) tells the SSD controller that deleted blocks are no longer needed, allowing them to be erased during garbage collection, which can destroy evidence that would persist on an HDD. Option B is not SSD-specific, since file system metadata can be overwritten on any storage medium. Option C is incorrect because magnetic remanence is a property of magnetic HDD platters, not SSDs. Option D is not SSD-specific either, as slack space remnants of deleted files exist in file systems on both HDDs and SSDs.

Answer

File system metadata may be overwritten

Answer

Magnetic remanence allows data recovery

Answer

Slack space contains remnants of deleted files

Question 15

An investigator needs to parse and analyze a Microsoft Outlook personal folders file (.pst). Which tool is specifically designed for this purpose?

Accepted Answer

Aid4Mail. Aid4Mail is a forensic email analysis tool that can parse Outlook PST files, among other formats, and extract metadata, attachments, and headers.

Answer

FTK Imager

Answer

Wireshark

Answer

Sleuth Kit