CHFI Practice Test 5 — 25 Questions

Question 1

A forensic analyst is examining browser history from a Chrome installation on a Windows system. Where is the Chrome history database typically stored?

Accepted Answer

%LOCALAPPDATA%\Google\Chrome\User Data\Default\History. Chrome stores its browsing history in a SQLite database file named 'History' located under the user's local app data directory. The full path is %LOCALAPPDATA%\Google\Chrome\User Data\Default\History. This file contains tables such as 'urls' and 'visits' that record all visited URLs, timestamps, and visit counts.

Answer

%APPDATA%\Mozilla\Firefox\Profiles\

Answer

%WINDIR%\System32\config\

Answer

%USERPROFILE%\Favorites\

Question 2

A forensic analyst is using Plaso (log2timeline) to create a super timeline from a compromised Windows system. Which of the following is the PRIMARY advantage of using Plaso over manual timeline creation?

Accepted Answer

It automatically correlates events from different sources and provides a unified timeline. Plaso (log2timeline) is designed to automatically parse and correlate artifacts from multiple sources—such as Windows Event Logs, Registry hives, Prefetch files, and USN journals—into a single, unified super timeline. This eliminates the need for manual correlation across disparate log files, which is error-prone and time-consuming, making automated correlation the primary advantage over manual timeline creation.

Answer

It can detect malware by signature scanning

Answer

It generates a timeline only from Windows Event Logs

Answer

It encrypts the timeline for secure storage

Question 3

A Linux system administrator notices that the /var/log/auth.log file shows many 'Failed password for root' entries from a single IP address within a short timeframe. Which tool would BEST help the administrator block further access from that IP?

Accepted Answer

iptables. B (iptables) is correct because it is a Linux firewall utility that can create rules to drop or reject incoming packets from a specific IP address. By adding a rule such as `iptables -A INPUT -s <IP> -j DROP`, the administrator can immediately block all further traffic from that IP, preventing additional brute-force attempts.

Answer

nmap

Answer

tcpdump

Answer

Wireshark

Question 4

A forensic analyst is examining a Windows 10 system and finds suspicious activity. Which registry hive contains user-specific configuration data that can reveal evidence of recent file access through ShellBags, UserAssist, and MRU lists?

Accepted Answer

NTUSER.DAT. The NTUSER.DAT file is the registry hive that stores user-specific configuration data for each user profile on a Windows 10 system. It contains the ShellBags keys (for folder view settings and recent folder access), UserAssist keys (tracking GUI-based program executions via the ROT13-encoded count and timestamp), and MRU (Most Recently Used) lists (for recently opened files and applications). These artifacts are critical for forensic analysis of user activity, and they are not stored in any of the HKLM hives, which are machine-wide.

Answer

HKLM\SYSTEM

Answer

HKLM\SAM

Answer

HKLM\SOFTWARE

Question 5

During a forensic investigation of a compromised Linux server, you find the following entry in /var/log/auth.log: 'Mar 10 03:14:15 server sshd[1234]: Accepted publickey for root from 10.0.0.5 port 54321 ssh2: RSA SHA256:AbCdEf123456'. Which artifact should you examine next to determine if unauthorized key-based access occurred?

Accepted Answer

~/.ssh/authorized_keys. The log entry shows a successful public key authentication from root. To determine if this key-based access was unauthorized, you must examine the ~/.ssh/authorized_keys file for the root user. This file contains the public keys that are authorized to log in as root; if the key fingerprint SHA256:AbCdEf123456 is present, the access was legitimate; if absent, it indicates an unauthorized key was added by an attacker.

Answer

/var/log/syslog

Answer

/etc/ssh/sshd_config

Answer

/etc/passwd

Question 6

A security analyst reviews firewall logs and sees repeated outbound connections from an internal server to an external IP on port 443. The server is not supposed to initiate outbound connections. Which action should the analyst take FIRST?

Accepted Answer

Investigate the server for signs of compromise. The server is exhibiting anomalous behavior by initiating outbound connections on port 443 (HTTPS) when it should not be doing so. This is a classic indicator of a potential compromise, such as a command-and-control (C2) callback or data exfiltration. The first priority is to investigate the server for signs of compromise to understand the scope and nature of the threat before taking any disruptive action.

Answer

Block the external IP at the firewall

Answer

Ignore the traffic as it is encrypted

Answer

Disable the server's network connection

Question 7

A company's legal department issues a legal hold notice for electronically stored information (ESI) related to a pending lawsuit. The IT department is tasked with preserving data. Which of the following actions is MOST likely to violate the legal hold requirements?

Accepted Answer

Continuing to run a script that deletes temporary files older than 24 hours.. Continuing to run a script that deletes temporary files older than 24 hours directly destroys ESI that may be relevant to the lawsuit, violating the legal hold requirement to preserve all potentially relevant data. Legal hold mandates the suspension of any automated or manual processes that could alter or delete ESI, including temporary files that might contain fragments of relevant documents or metadata. Unlike suspending routine email deletion (Option B), which is a preservation action, the script actively purges data and thus breaches the hold.

Answer

Notifying all employees to preserve documents related to the lawsuit.

Answer

Suspending routine deletion of emails older than 30 days.

Answer

Taking a forensic image of the relevant servers.

Question 8

An analyst captures network traffic during an incident and wants to extract files transferred over HTTP. Which Wireshark feature is BEST suited for this task?

Accepted Answer

Export Objects > HTTP. Wireshark's 'Export Objects > HTTP' feature is specifically designed to extract files (e.g., images, documents, executables) transferred over HTTP by reassembling the TCP streams and parsing the HTTP response bodies. This feature automates the extraction process, saving the analyst from manually reconstructing each file from raw packets.

Answer

Follow TCP Stream

Answer

Statistics > HTTP

Answer

Analyze > Expert Info

Question 9

During a Linux forensic investigation, you find that the file /var/log/auth.log has been deleted. Which of the following artefacts would BEST help determine recent SSH login attempts?

Accepted Answer

Output of the 'last' command. The 'last' command reads the /var/log/wtmp binary log file, which records all login and logout events, including SSH sessions. Even if /var/log/auth.log is deleted, the wtmp file persists and provides a reliable record of recent SSH login attempts, making option D the best choice.

Answer

Contents of /etc/shadow

Answer

Bash history from /root/.bash_history

Answer

Cron job entries in /etc/crontab

Question 10

Which tool is specifically designed for timeline analysis in digital forensics and is the command-line version of the log2timeline framework?

Accepted Answer

Plaso. Plaso (Python Log2Timeline) is the command-line version of the log2timeline framework, specifically engineered for super timeline creation and timeline analysis in digital forensics. It parses multiple log and artifact sources (e.g., Windows Event Logs, Prefetch, Registry hives) into a unified, high-performance timeline database (SQLite or Elasticsearch), enabling examiners to correlate events across time. This makes it the direct answer to a question asking for the CLI tool derived from the log2timeline framework.

Answer

Autopsy

Answer

Sleuth Kit

Answer

Wireshark

Question 11

In Linux forensics, which file contains information about user account passwords in hashed form?

Accepted Answer

/etc/shadow. In Linux, the /etc/shadow file stores user account passwords in hashed form, along with password aging information. This file is readable only by root (or privileged processes) to prevent unauthorized access to password hashes, unlike /etc/passwd which is world-readable and historically stored hashes but now typically shows an 'x' placeholder. The hashes are generated using algorithms like SHA-512 (crypt $6$) or yescrypt, as specified in the shadow file format.

Answer

/etc/passwd

Answer

/etc/group

Answer

/var/log/auth.log

Question 12

During a forensic examination of a Windows 10 system, you find a file named "chrome_000001.jumplist" in the user's AppData directory. What does the presence of this file indicate?

Accepted Answer

The file stores recent items accessed through Chrome, such as downloaded files. Jump lists in Windows store recently accessed items for applications pinned to the taskbar or recently used. The file 'chrome_000001.jumplist' is a Windows-generated binary file that logs recent documents, downloads, or URLs opened via Google Chrome. Its presence indicates the user has recently accessed files or links through Chrome, making D correct.

Answer

The file is a Chrome extension

Answer

The user has installed Chrome via a jump list installer

Answer

The file contains Chrome bookmarks

Question 13

A security analyst is investigating a potential intrusion and finds a webshell on a Linux web server. Which of the following logs would be MOST useful to determine how the webshell was uploaded?

Accepted Answer

/var/log/apache2/access.log. The Apache access log (/var/log/apache2/access.log) records every HTTP request made to the web server, including the method (e.g., POST), URI, source IP, and user-agent. A webshell is typically uploaded via a file upload vulnerability or a crafted HTTP request (e.g., PUT or POST with multipart/form-data), so the access log will show the exact request that transferred the malicious file to the server, making it the most useful for determining the upload vector.

Answer

/var/log/syslog

Answer

/var/log/auth.log

Answer

/var/log/kern.log

Question 14

In a macOS forensic investigation, which log system stores high-level events such as application launches and authentication attempts in a binary format, and can be queried using the 'log' command?

Accepted Answer

Unified logging. Unified logging is the correct answer because macOS stores high-level events like application launches and authentication attempts in a binary format within the unified log system (stored in /var/db/diagnostics/ and /var/db/uuidtext/). The 'log' command is the native tool to query these logs, using predicates and options such as 'log show' or 'log stream', making it the only option that matches both the binary format and the query method described.

Answer

system.log

Answer

Audit log

Answer

FSEvents

Question 15

Which Windows Event ID is generated when a new service is installed on a system, and is often used by malware to establish persistence?

Accepted Answer

7045. Event ID 7045 is generated by the Windows Service Control Manager (SCM) when a new service is installed on the system. Malware often uses this event to establish persistence by creating a service that automatically starts, and forensic analysts look for 7045 events to detect unauthorized service installations.

Answer

4624

Answer

4648

Answer

4720

Question 16

An analyst reviews an Apache access log entry: '192.168.1.10 - - [10/Oct/2023:13:55:36 +0000] "GET /index.php?id=1%27%20OR%20%271%27%3D%271 HTTP/1.1" 200 1234 "-" "Mozilla/5.0"'. Which attack does this log entry most likely indicate?

Accepted Answer

SQL injection (SQLi) attack. The URL-encoded payload contains SQL injection syntax (%27 is a single quote), attempting to inject an OR condition. This is indicative of a SQL injection attempt.

Answer

Cross-site scripting (XSS) attack

Answer

Path traversal attack

Answer

Remote file inclusion (RFI) attack

Question 17

A forensic analyst needs to create a timeline of file system activity from a disk image. Which tool is specifically designed for this purpose and can parse various artifacts such as registry, prefetch, and log files?

Accepted Answer

Plaso (log2timeline). Plaso (log2timeline) is the correct tool because it is specifically designed to create super timelines of file system activity from disk images. It parses a wide range of artifacts including the Windows Registry, Prefetch files, event logs, and other log files, correlating timestamps to reconstruct a chronological sequence of system events.

Answer

Wireshark

Answer

Volatility

Answer

FTK Imager

Question 18

An investigator is analyzing a compromised MySQL database server. To determine the exact time and content of a suspect data exfiltration query, which MySQL log should be examined first, assuming it is enabled?

Accepted Answer

General query log. The general query log records every SQL statement received by the MySQL server, including SELECT queries used for data exfiltration. Since the investigator needs the exact time and content of the suspect query, this log provides a complete, chronological record of all client-sent statements, making it the primary source for identifying the exfiltration event.

Answer

Error log

Answer

Binary log

Answer

Slow query log

Question 19

A network forensics analyst captures traffic from a suspected data exfiltration. In Wireshark, filtering for DNS queries containing a long subdomain with base64-encoded text suggests which technique?

Accepted Answer

DNS tunneling. DNS tunneling encodes data (often base64) into DNS query subdomains to bypass network controls and exfiltrate information. Wireshark filtering for unusually long DNS queries with encoded text directly reveals this technique, as legitimate DNS queries rarely contain such payloads.

Answer

DNS hijacking

Answer

DNS poisoning

Answer

DNS amplification

Question 20

A Windows system is suspected of having malware that maintains persistence by starting every time a user logs in. Which registry key should be examined FIRST for this persistence mechanism?

Accepted Answer

Run keys. The Run keys (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) are the most common and straightforward persistence mechanism for malware that executes on user login. These registry keys specify programs that automatically run when a user logs into their account, making them the first place to check for such persistence.

Answer

ShellBags

Answer

NTUSER.DAT

Answer

HKLM\SAM