CHFI Practice Test 5 — 25 Questions

Question 1

A Docker container is suspected of malicious activity. Which THREE data sources should the investigator collect for forensic analysis?

Accepted Answer

Host system audit logs. Container logs, image layers, and host system logs are key sources in Docker forensics.

Answer

Network packet captures from the container's virtual interface

Answer

The Dockerfile used to build the image

Question 2

A forensic analyst is investigating a Docker container that was used to launch a network attack. The container has been stopped but not removed. Which action should the analyst take FIRST to preserve volatile evidence?

Accepted Answer

Use 'docker commit' to create an image of the container. Preserving the container's file system and logs is key. 'docker commit' creates an image from the container's current state. 'docker export' exports the filesystem as a tar archive. 'docker logs' retrieves logs. 'docker inspect' shows metadata. The container is stopped, so 'docker exec' won't work without starting it, which alters state. 'docker save' saves images, not containers. The best first step is to create an image or export the filesystem.

Answer

Restart the container and use 'docker exec' to collect evidence

Answer

Use 'docker inspect' to view container metadata only

Answer

Use 'docker save' to export the container as a tar file

Question 3

During a forensic examination of an NTFS drive, an analyst runs 'fsutil usn readjournal C:' and observes a large number of USN journal entries for a specific file after a certain date. The file's $MFT record shows a last modified timestamp far earlier than the journal entries. What does this discrepancy suggest?

Accepted Answer

The file's metadata was modified without changing its content, possibly using timestomping or ADS manipulation. The USN journal records all changes to files and directories on an NTFS volume, including metadata modifications. When the USN journal shows numerous entries after a date but the $MFT record's last modified timestamp is earlier, it indicates that the file's metadata (e.g., timestamps, ADS) was altered without updating the $MFT's last modified field—a classic sign of timestomping or ADS manipulation. This discrepancy arises because timestomping tools can directly modify $MFT attributes while the USN journal still logs the change event.

Answer

The file is a system file that is excluded from USN journaling

Answer

The file system is corrupted and the MFT is not updating correctly

Answer

The file was accessed via a mounted volume shadow copy, which does not update MFT

Question 4

Which FOUR of the following are persistence mechanisms that can be used on Linux systems?

Accepted Answer

SSH authorized keys. Persistence mechanisms on Linux include SSH authorized keys (B), which allow an attacker to maintain remote access by adding their public key to the target user's authorized_keys file; startup scripts in /etc/init.d (C), which execute at boot; cron jobs (D), which run scheduled tasks; and modifications to /etc/passwd (E) to create persistent user accounts. Prefetch files (A) are Windows-specific and not a Linux persistence mechanism.

Answer

Prefetch files

Question 5

An investigator notes that a file on an NTFS volume has a resident data size of 900 bytes, but the $DATA attribute lists an allocated size of 1024 bytes. What does this indicate?

Accepted Answer

The file has slack space that may contain remnants of previously deleted data. On an NTFS volume, when a file's data is stored as a resident attribute within the MFT, the $DATA attribute's allocated size is typically 0 because the data occupies space only within the MFT record itself. Here, the allocated size is 1024 bytes, which is larger than the resident data size of 900 bytes. This indicates that the file is stored non-resident (i.e., in clusters outside the MFT), and the allocated size reflects the cluster size (e.g., 1024 bytes per cluster). The difference between the allocated size (1024 bytes) and the actual data size (900 bytes) is slack space, which may contain remnants of previously deleted data.

Answer

The file is compressed using NTFS compression

Answer

The file's data is stored in the MFT as a resident attribute

Answer

The file is stored in an alternate data stream

Question 6

Refer to the exhibit. A database administrator finds the above error log entries when attempting to start the MySQL service. The server was working fine yesterday. What is the most likely cause of this issue?

Accepted Answer

The InnoDB system tablespace file (ibdata1) is corrupted.. The error log entries indicate that InnoDB is unable to open or read the system tablespace file (ibdata1), which is the core file storing the InnoDB data dictionary, undo logs, and doublewrite buffer. A corrupted ibdata1 prevents MySQL from starting because the storage engine cannot initialize its internal structures, even if the server was operational the previous day. This matches the symptom of a sudden failure without prior configuration changes.

Answer

The MySQL user does not have write permissions to the data directory.

Answer

The binary log is full and cannot be rotated.

Answer

The server ran out of memory due to high innodb_buffer_pool_size.

Question 7

Refer to the exhibit. A first responder runs the netstat command on a compromised Windows workstation. Which of the following conclusions is BEST supported by the output?

Accepted Answer

A process with PID 1234 is likely communicating with a remote C2 server at 10.2.3.4.. An established TCP connection (ESTABLISHED state) from the workstation to a remote IP on a high ephemeral port (49152) with PID 1234 strongly indicates active communication. This is a classic indicator of a beaconing C2 channel, as legitimate outbound connections typically use well-known ports or are short-lived. The netstat output shows PID 1234 has a persistent connection to 10.2.3.4:4444, which is a common port for malware command and control.

Answer

The connection to 192.168.1.1:80 is suspicious because it is in TIME_WAIT state.

Answer

The UDP listener on port 5353 indicates a malware infection.

Answer

The workstation is running multiple virtual machines based on the local addresses.

Question 8

A forensic examiner needs to create a bit-for-bit copy of a suspect's hard drive for analysis. Which tool is specifically designed for this purpose and can also verify integrity using hashing?

Accepted Answer

dd. The `dd` command is a Unix/Linux utility that performs low-level bit-for-bit copying of storage devices, creating an exact forensic image (e.g., raw .dd or .img format). It can verify integrity by piping the output through a hashing tool like `md5sum` or `sha256sum`, or by using `dd` with `conv=noerror,sync` and later comparing hash values of the source and destination.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 9

An analyst is recovering deleted files from a FAT32 file system. The file system uses a cluster size of 4096 bytes. The first cluster of a deleted file is cluster 100. Which structure contains the chain of clusters for this file?

Accepted Answer

File Allocation Table (FAT). The File Allocation Table (FAT) is the core structure that stores the chain of clusters for files in FAT32 file systems. When a file is deleted, its directory entry is marked as available, but the FAT entries for its clusters (starting at cluster 100) remain intact until overwritten, allowing recovery by following the cluster chain in the FAT.

Answer

Volume boot record

Answer

Directory entry

Answer

Boot sector

Question 10

During a forensic analysis of a compromised web server, an investigator identifies the following log entries. Which THREE entries are the strongest indicators of a successful web shell upload? (Choose three.)

Accepted Answer

POST /upload.php HTTP/1.1 200 0. Successful uploads of aspx or php files that contain web shell code (e.g., with cmd parameter) and subsequent access to those files are strong indicators. The 404 for cmd.exe indicates a path traversal attempt, not a web shell.

Answer

GET /../../windows/system32/cmd.exe HTTP/1.1 404 - -

Answer

GET /images/logo.png HTTP/1.1 304 - -

Question 11

An analyst finds the following string in an IIS log: %3Cscript%3Ealert('XSS')%3C/script%3E. What does this indicate?

Accepted Answer

A cross-site scripting (XSS) attempt. The string is URL-encoded HTML/JavaScript (). It is a typical cross-site scripting payload attempting to execute in a browser.

Answer

A SQL injection attempt

Answer

A buffer overflow attempt

Answer

A path traversal attempt

Question 12

Which cloud service log is most appropriate for tracking API calls and resource changes in an AWS environment?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity and resource changes.

Answer

AWS VPC Flow Logs

Answer

AWS Config

Answer

AWS CloudWatch Logs

Question 13

A security analyst notices repeated entries in an IIS log: 10.0.0.2, -, 05/Feb/2023:08:12:34 +0000, GET /../../windows/system32/config/sam, 404, 0, 532. Which TWO of the following attack types are indicated by this log entry?

Accepted Answer

Directory traversal. The use of '../' indicates path traversal, and the target file (SAM) is a common target for privilege escalation.

Answer

SQL injection

Answer

Denial of service

Answer

Cross-site scripting

Question 14

During an investigation of a web application breach, an analyst reviews IIS logs and finds numerous entries with status code '200' and URIs containing '?cmd=' followed by encoded strings. The analyst also notices that some requests have a 'User-Agent' string resembling 'Microsoft-CryptoAPI/10.0'. What is the MOST likely conclusion?

Accepted Answer

A webshell is being used to execute commands on the server. The presence of numerous HTTP 200 (success) responses with URIs containing '?cmd=' followed by encoded strings indicates that an attacker is sending command execution requests to a webshell on the server. The unusual User-Agent string 'Microsoft-CryptoAPI/10.0' is a known evasion technique used by webshell tools (e.g., China Chopper variants) to blend in with legitimate Windows update traffic. Successful command execution returns a 200 status, confirming the webshell is active and under attacker control.

Answer

The logs indicate a successful SQL injection attack

Answer

The logs show a cross-site scripting (XSS) attack targeting administrators

Answer

The server is infected with ransomware, encrypting files

Question 15

A forensic analyst is investigating a Windows system for persistence mechanisms. Which TWO registry locations are commonly used by malware to achieve auto-start? (Select TWO.)

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard auto-start location where malware can add entries to execute programs when a user logs in. This key is commonly abused because it does not require administrative privileges to modify, making it a frequent persistence mechanism for user-level malware.

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKLM\SAM\SAM

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Question 16

Which Linux log file is the PRIMARY source for authentication-related events such as user logins, sudo usage, and failed authentication attempts?

Accepted Answer

/var/log/auth.log. /var/log/auth.log is the primary log file on Linux systems (especially Debian/Ubuntu) that records authentication-related events, including user logins (via sshd, login, su), sudo command executions, and failed authentication attempts. This log is generated by the authpriv facility in syslog and is specifically designed to capture security and authentication messages, making it the go-to source for forensic analysis of user access and privilege escalation.

Answer

/var/log/kern.log

Answer

/var/log/syslog

Answer

/var/log/boot.log

Question 17

A forensic investigator is examining a Mac system and wants to review recently accessed files and applications. Which macOS artifact is MOST useful for this purpose?

Accepted Answer

FSEvents (/.fseventsd). FSEvents (/.fseventsd) is the correct choice because it maintains a persistent, chronological record of file system changes on macOS, including file accesses and modifications. This artifact allows an investigator to reconstruct a timeline of recently accessed files and applications, as the FSEvents daemon logs events such as file opens, renames, and deletions at the volume level, making it the most direct source for this purpose.

Answer

bash_history

Answer

.plist files in ~/Library/Preferences/

Answer

Unified Logging (log stream)

Question 18

Which tool is specifically designed to analyze email headers, track the path of an email, and extract metadata such as originating IP and authentication results?

Accepted Answer

EmailTracker. EmailTracker is specifically designed to parse email headers, trace the email's path through mail servers, and extract metadata such as the originating IP address, authentication results (SPF, DKIM, DMARC), and timestamps. Unlike general-purpose tools, it focuses solely on email header analysis and visualization, making it the correct choice for this task.

Answer

Volatility

Answer

Wireshark

Answer

FTK Imager

Question 19

You are a forensic investigator responding to an incident on a Windows 10 workstation used by a finance manager. The user reports that a critical spreadsheet containing quarterly budget data was accidentally deleted from the Desktop yesterday at approximately 3:00 PM. The system has been used normally since then, and the user has not emptied the Recycle Bin. You have created a forensic image of the drive using FTK Imager. The Recycle Bin contains a file named 'Quarterly_Budget.xlsx', but it appears to be a shortcut (size 1 KB). The user insists the original file was several megabytes. You need to recover the original file. Which action should you take next?

Accepted Answer

Search the $Recycle.Bin folder on the forensic image to locate the original file data, which may be stored under a different name.. When a file is moved to the Recycle Bin on Windows 10, the original file data is not stored in the Recycle Bin itself; instead, a hidden file (with a random name) is created in the `$Recycle.Bin` folder on the volume, and a shortcut (the visible entry) is placed in the Recycle Bin. The shortcut points to the hidden file, which retains the original data. Since the visible entry is only 1 KB, the actual file content must be located in the `$Recycle.Bin` folder under a different name, making option A the correct next step.

Answer

Restore a previous version of the Desktop folder from Volume Shadow Copy.

Answer

Use file carving techniques to recover the file from unallocated space on the Desktop.

Answer

Check the Recycle Bin on the live system; the file should be there and can be restored.

Question 20

A legal hold is issued by an organization's legal department. What is the primary purpose of a legal hold?

Accepted Answer

To preserve all relevant data that may be needed for a legal case. A legal hold is a directive issued by an organization's legal department to suspend the routine deletion or alteration of data that may be relevant to pending or reasonably anticipated litigation. Its primary purpose is to preserve all potentially relevant electronically stored information (ESI) and physical records in their current state, ensuring spoliation does not occur. This obligation arises under the Federal Rules of Civil Procedure (FRCP) Rule 37(e) and similar e-discovery regulations, which require organizations to take reasonable steps to preserve data once litigation is reasonably anticipated.

Answer

To notify employees that litigation is pending

Answer

To authorize law enforcement to seize computers

Answer

To encrypt all company data for security