CHFI Practice Test 4 — 25 Questions

Question 1

During a forensic analysis of a compromised Linux server, you notice that the file /var/log/auth.log has been cleared. However, you find that the attacker's commands are still partially recoverable. Which artifact most likely contains the attacker's command history?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

~/.bash_history. The ~/.bash_history file stores the command history for individual user accounts, including commands executed by an attacker who gained shell access. Even if /var/log/auth.log is cleared, this file retains the attacker's command history unless explicitly deleted or truncated. This makes it a key artifact for recovering attacker activity.

Answer

/var/log/syslog

Answer

/proc/1/cmdline

Answer

/etc/shadow

Question 2

A forensic investigator analyzing a RAID 5 array of three disks notices that one disk has failed. Can the investigator still reconstruct the data?

Accepted Answer

Yes, using the parity information from the remaining disks. RAID 5 uses distributed parity across all disks in the array. When one disk fails, the data can be reconstructed by XORing the data and parity from the remaining disks. Since the parity is spread across all disks (not a dedicated parity disk), the investigator can rebuild the missing data as long as the remaining disks are functional.

Answer

No, RAID 5 requires all disks to be present

Answer

Yes, but only if the failed disk is the parity disk

Answer

No, because RAID 5 does not support hot swapping

Question 3

What is the primary difference between MBR and GPT partition tables?

Accepted Answer

GPT uses a cyclic redundancy check (CRC) for integrity; MBR does not. GPT (GUID Partition Table) uses a cyclic redundancy check (CRC32) to verify the integrity of the partition table header and entries, detecting corruption or tampering. MBR (Master Boot Record) lacks any such integrity check, making it vulnerable to undetected corruption. This CRC mechanism is a fundamental design improvement in GPT over MBR.

Answer

MBR is used only on Linux; GPT is used on Windows

Answer

MBR supports larger disks than GPT

Answer

GPT stores the partition table only in the first sector

Question 4

During a forensic investigation, an analyst recovers a hard drive that uses GPT partitioning. The analyst needs to locate the backup GPT header to verify partition table integrity. Where is the backup GPT header typically stored on the disk?

Accepted Answer

The last sector of the disk. The backup GPT header is stored in the last sector of the disk (LBA -1) to provide redundancy. If the primary GPT header in LBA 1 is corrupted, the backup can be used to reconstruct the partition table. This design ensures the GPT structure can be recovered even if the beginning of the disk is damaged.

Answer

The first sector of the last partition

Answer

Sector 0 (the MBR sector)

Answer

Sector 1 (immediately after the protective MBR)

Question 5

A network forensic analyst examines a pcap file in Wireshark and sees an HTTP POST request to '/shell.jsp' with a parameter 'cmd' containing 'dir'. The response contains a directory listing. Which intrusion artifact is indicated?

Accepted Answer

Webshell. The HTTP POST request to '/shell.jsp' with a 'cmd' parameter containing 'dir' and a response showing a directory listing is a classic indicator of a webshell. A webshell is a malicious script (e.g., JSP, ASP, PHP) uploaded to a web server that allows an attacker to execute arbitrary system commands via HTTP requests, effectively providing remote command execution. The presence of a command parameter and the server's response executing that command directly confirms the artifact is a webshell.

Answer

SQL injection

Answer

Directory traversal

Answer

Cross-site scripting (XSS)

Question 6

In Linux forensics, an investigator examines /var/log/auth.log and finds repeated entries of "Failed password for root from 10.0.0.5 port 22 ssh2". Which type of attack is most likely indicated?

Accepted Answer

Brute force attack on SSH. Repeated 'Failed password for root' entries in /var/log/auth.log indicate multiple authentication attempts against the SSH service. This pattern is characteristic of a brute force attack, where an attacker systematically tries many passwords to gain unauthorized access to the root account via SSH.

Answer

DNS cache poisoning attack

Answer

SQL injection attack

Answer

ARP spoofing attack

Question 7

A forensic analyst is examining a RAID 5 array consisting of three disks. One disk has failed and has been replaced. The array is rebuilt automatically. However, the analyst needs to recover deleted files that existed before the rebuild. What is the MOST significant challenge in this scenario?

Accepted Answer

The rebuild process may overwrite data in slack space and previously unallocated clusters. When a RAID 5 array with a failed disk is rebuilt, the controller reconstructs data using parity information and writes it to the replacement disk. This rebuild process writes to all previously unallocated clusters and slack space across the array, potentially overwriting the very data the analyst hopes to recover. Deleted files that existed before the rebuild are at high risk of being overwritten during this automatic reconstruction, making recovery extremely difficult or impossible.

Answer

File carving techniques do not work on RAID volumes

Answer

The file system becomes corrupted after rebuild

Answer

The RAID controller encrypts data, preventing direct disk access

Question 8

During a forensic investigation of a compromised web server, an analyst finds the following entry in the IIS access log: 192.168.1.5, -, 04/May/2024:14:23:11, GET /scripts/..%5c../windows/system32/cmd.exe, 200. What is the probable attack vector?

Accepted Answer

Path traversal. The log shows a path traversal attempt using URL-encoded backslashes (%5c) to navigate to cmd.exe. The 200 status indicates the request succeeded. This is a classic path traversal attack.

Answer

Brute force attack

Answer

Cross-site scripting

Answer

SQL injection

Question 9

A security analyst investigates a Windows system and finds an event with ID 4625 in the Security log. What does this event indicate?

Accepted Answer

A failed logon attempt. Event ID 4625 in the Windows Security log specifically indicates a failed logon attempt. This event is generated by the Local Security Authority Subsystem Service (LSASS) whenever an authentication attempt fails, regardless of the logon type (interactive, network, service, etc.). The event details include the account name, source IP address, and failure reason code (e.g., 0xC000006D for bad username/password).

Answer

A successful user logon

Answer

A service was installed

Answer

A new user account was created

Question 10

An analyst detects a large amount of data being exfiltrated from a network over DNS queries. Which type of network analysis would BEST detect this activity?

Accepted Answer

Packet capture analysis. Packet capture analysis (C) is the best method because DNS exfiltration involves encoding stolen data into DNS query or response fields (e.g., subdomains, TXT records). Only full packet capture allows inspection of the raw DNS payloads, including the actual query names and response data, which is necessary to detect the anomalous patterns of data being tunneled over DNS. Proxy, firewall, and IDS/IPS logs typically only record metadata (source/destination, timestamps, allowed/denied actions) and do not provide the granularity to see the encoded data within DNS packets.

Answer

Proxy log analysis

Answer

Firewall log analysis

Answer

IDS/IPS log analysis

Question 11

A forensic analyst discovers an unusual entry in the Windows Registry under 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run'. Which persistence mechanism does this represent?

Accepted Answer

Registry Run key persistence. The registry key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' is a standard Windows Registry Run key that automatically launches specified programs when a user logs in. This is a well-known persistence mechanism used by both legitimate software and malware to maintain foothold on a system. The presence of an unusual entry here indicates an attempt to achieve persistence via the registry.

Answer

Service installation

Answer

Scheduled task

Answer

Startup folder

Question 12

Which network forensic technique involves analyzing the flow of network traffic to identify patterns and anomalies, often using tools like SiLK or nfdump?

Accepted Answer

NetFlow analysis. NetFlow analysis is the correct technique because it focuses on collecting and analyzing IP traffic flow metadata (e.g., source/destination IPs, ports, protocols, packet counts) to detect patterns and anomalies. Tools like SiLK and nfdump are specifically designed to process NetFlow data, making this the precise match for the question's description.

Answer

Port scanning

Answer

Signature-based detection

Answer

Deep packet inspection

Question 13

An analyst suspects that an attacker used a web shell to execute commands on a Windows web server. Which Windows event ID should the analyst look for to detect service installation that may have been used for persistence?

Accepted Answer

7045. Event ID 7045 is logged by the Windows Service Control Manager when a new service is installed on the system. An attacker who gains a web shell often installs a malicious service to maintain persistence, and this event captures the service name, binary path, and service type, making it the primary forensic artifact to detect such activity.

Answer

4624

Answer

4648

Answer

4720

Question 14

An analyst reviews Windows Registry for USB device usage history. Which registry hive and key contain the 'USBSTOR' key that logs unique serial numbers of connected USB drives?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key is located under HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR and logs each unique USB device by its serial number. This hive is part of the SYSTEM registry, which maintains device enumeration data used by the Plug and Play manager to track connected hardware. Forensic analysts examine this key to identify USB drive insertion history, including first and last connection timestamps.

Answer

HKLM\SAM\SAM\Domains\Account\Users

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Question 15

During a forensic investigation, a junior analyst suggests using a software write blocker to image a suspect's hard drive. Which of the following is the PRIMARY concern with relying solely on a software write blocker in a high-stakes legal case?

Accepted Answer

Software write blockers may be circumvented if the operating system is compromised.. Software write blockers are not as reliable as hardware ones because they rely on the operating system, which can be compromised; hardware write blockers provide physical write protection.

Answer

Software write blockers require additional licensing fees.

Answer

Software write blockers are not compatible with all operating systems.

Answer

Software write blockers are too slow for large drives.

Question 16

Refer to the exhibit. During a malware investigation, a forensic analyst runs the commands shown. What is the most likely conclusion?

Accepted Answer

Rundll32.exe with PID 1500 is likely a backdoor listening on port 4444.. The netstat output shows a listening connection on port 4444 associated with PID 1500, which the tasklist command identifies as rundll32.exe. Port 4444 is a common backdoor port (often used by Metasploit or other RATs), and rundll32.exe is a legitimate Windows binary frequently abused by malware to host malicious code (e.g., via DLL sideloading or reflective injection). The combination of an unusual listening port and a process that is not a typical network service (like svchost.exe) strongly indicates a backdoor.

Answer

Svchost.exe processes are hosting legitimate Windows services; no malware is present.

Answer

The malware has injected code into svchost.exe using a reflective DLL injection tool.

Answer

The malware is using port 4444 for Windows Update communications.

Question 17

During a Linux forensic investigation, you find a suspicious cron job in /etc/cron.d/malware that runs every 5 minutes as root. Which persistence mechanism is being used?

Accepted Answer

Cron job. The cron daemon reads job definitions from files in /etc/cron.d/ and executes them according to the schedule specified. Finding a file named 'malware' in /etc/cron.d/ that runs every 5 minutes as root directly indicates a cron job persistence mechanism, as this is the standard location for system-wide cron entries.

Answer

Bash history

Answer

Systemd service

Answer

Init script

Question 18

A forensic analyst finds multiple Prefetch files in C:\Windows\Prefetch with recent timestamps. What is the primary value of Prefetch files in an investigation?

Accepted Answer

They record the first and last execution times of applications. Prefetch files in Windows store metadata about application launches, including the first and last execution times. This allows forensic analysts to determine when a specific program was run, which is crucial for timeline analysis and identifying unauthorized or malicious software execution.

Answer

They store the user's web browsing history

Answer

They list all network connections made by the system

Answer

They contain the actual content of user documents

Question 19

A security analyst reviews Windows Security Event Log and notices multiple Event ID 4625 entries for a single user account from various IP addresses within a short time frame. What is the MOST likely attack being attempted?

Accepted Answer

Brute-force password attack. Event ID 4625 indicates a failed logon attempt. Multiple such events for a single user account from various IP addresses within a short time frame is the classic signature of a brute-force password attack, where an attacker tries many passwords against one account from multiple source IPs to evade rate-limiting or IP-based blocking.

Answer

Kerberos golden ticket attack

Answer

ARP spoofing attack

Answer

Pass-the-hash attack

Question 20

A security analyst is reviewing Windows Event Logs and notices multiple Event ID 4625 entries for a single user account within a short time frame. What does this most likely indicate?

Accepted Answer

A brute-force password guessing attack. Event ID 4625 is the Windows security log event for a failed logon attempt. A high frequency of these events for the same user account within a short time frame is a classic indicator of an automated brute-force password guessing attack, where an attacker tries multiple passwords against a single account.

Answer

Successful user logins

Answer

Account creation events

Answer

Service installation