CHFI Practice Test 27 — 15 Questions

Question 1

During incident response, a first responder discovers a compromised system with signs of an active command-and-control (C2) connection. What is the MOST important immediate action to preserve evidence and prevent further damage?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disconnect the network cable to isolate the system from the network.. Disconnecting the network cable immediately stops the active C2 communication, preventing further data exfiltration and command injection while preserving the current state of memory and disk. This action maintains the integrity of volatile evidence (e.g., network connections, running processes) and avoids the data loss that would occur with a shutdown or the evidence contamination that would result from running a scan.

Answer

Create a full disk image before taking any other action.

Answer

Immediately shut down the system to prevent further data exfiltration.

Answer

Run a full antivirus scan to remove the malware.

Question 2

You are a forensic investigator responding to a suspected data breach at a financial institution. The incident response team has isolated a Windows 10 workstation used by a former employee. The system is still powered on, and the login screen is displayed. Your task is to acquire forensic evidence in a defensible manner. The following actions are available:

A. Immediately pull the power cord to perform a cold acquisition of the hard drive.
B. Capture volatile data (RAM, network connections, running processes) using a trusted tool on a USB drive, then shut down normally and remove the hard drive for imaging.
C. Boot the system from a forensic live CD and create a forensic image of the hard drive while the system is running.
D. Use the built-in Windows backup to create a system image to an external drive.

Which action is the most appropriate first step in this scenario?

Accepted Answer

Capture volatile data using a trusted tool on a USB drive, then shut down normally and remove the hard drive for imaging. The system is still powered on with the login screen displayed, meaning volatile data (RAM, network connections, running processes) is present and will be lost if the system is powered off. Capturing this data first using a trusted forensic tool (e.g., FTK Imager or DumpIt) from a write-blocked USB drive preserves critical evidence such as encryption keys, active network connections, and malware in memory. Only after volatile data is secured should the system be shut down normally and the hard drive removed for forensic imaging, ensuring a defensible chain of custody.

Answer

Use the built-in Windows backup to create a system image to an external drive

Answer

Boot the system from a forensic live CD and create a forensic image of the hard drive while the system is running

Answer

Immediately pull the power cord to perform a cold acquisition of the hard drive

Question 3

An investigator needs to capture network traffic from a live network segment without altering the traffic flow. Which technique should they use?

Accepted Answer

Configure a SPAN port on the switch. A SPAN (Switched Port Analyzer) port, also known as a mirror port, copies all traffic from a specified source port or VLAN to a destination port where the forensic workstation is connected. This allows the investigator to capture traffic without injecting any frames or altering the forwarding behavior of the switch, thus preserving the integrity of the live network segment.

Answer

Enable NetFlow on the router and capture flows

Answer

Deploy an ARP spoofing tool to redirect traffic

Answer

Set the NIC to promiscuous mode on the forensic workstation

Question 4

An analyst notices that a file on an NTFS volume occupies 4096 bytes on disk but its actual data is only 100 bytes. The extra space contains remnants of a previously deleted file. What is this extra space called?

Accepted Answer

File slack. File slack is the unused space between the end of the actual file data and the end of the last allocated cluster for that file. On an NTFS volume with a 4096-byte cluster size, a 100-byte file leaves 3996 bytes of slack space, which may contain remnants of previously deleted files. This is why option D is correct.

Answer

Volume slack

Answer

Free space

Answer

RAM slack

Question 5

In an iOS forensic examination, an analyst extracts an encrypted iTunes backup. The backup contains a file named 'manifest.plist' which lists the backup version and encryption state. Which tool is specifically designed to brute-force the backup password using GPU acceleration?

Accepted Answer

Hashcat. Hashcat is the correct tool because it is a password recovery utility that leverages GPU acceleration to perform high-speed brute-force attacks on encrypted iTunes backup passwords. It can directly process the password hash extracted from the 'manifest.plist' file, which contains the backup version and encryption state, allowing efficient cracking of the backup password.

Answer

Oxygen Forensic Detective

Answer

Cellebrite UFED

Answer

GrayKey

Question 6

A forensic examiner is analyzing an Android device that has been factory reset. Which of the following artefacts is MOST likely to still be recoverable from the device's flash memory after a factory reset, assuming no overwrite has occurred?

Accepted Answer

User data such as photos and contacts. After a factory reset on an Android device, the operating system typically performs a 'fastboot format' or 'wipe data/factory reset' which only unmounts the userdata partition and marks its blocks as free in the ext4 or F2FS filesystem metadata. The actual user data (photos, contacts, etc.) remains physically stored in the NAND flash memory until those blocks are overwritten by new data. Because no overwrite has occurred in this scenario, the raw data is still recoverable using forensic tools that bypass the filesystem and read the flash memory directly.

Answer

The GUID Partition Table (GPT)

Answer

The device's encryption keys

Answer

The Android OS system files

Question 7

During a database forensic investigation, you need to review Microsoft SQL Server transaction logs to identify unauthorized data modifications. Which of the following SQL Server functions or commands is used to read the transaction log?

Accepted Answer

fn_dblog. The fn_dblog function is the correct choice because it is the undocumented but widely used SQL Server function that reads the transaction log (LDF file) directly, allowing forensic examiners to view every logged operation including data modifications, schema changes, and transaction details. Unlike other DMVs or commands, fn_dblog provides a row-by-row dump of the log records, making it essential for identifying unauthorized changes at the transaction level.

Answer

SELECT * FROM sys.dm_tran_database_transactions

Answer

DBCC LOG

Answer

BACKUP LOG

Question 8

A first responder arrives at a suspected intrusion scene. A desktop computer is powered on and logged in. The user claims they saw suspicious files being copied to a USB drive. Which of the following should the first responder do FIRST?

Accepted Answer

Capture volatile data such as memory and running processes.. In a live intrusion where a USB transfer is in progress, volatile data (memory, running processes, network connections) is the most ephemeral and will be lost if the system is powered down. Capturing this data first preserves evidence of the malicious activity, such as the process that initiated the copy and any network connections, which is critical for reconstructing the attack. This follows the order of volatility (RFC 3227), which mandates capturing volatile data before non-volatile data.

Answer

Power off the computer immediately to prevent further data loss.

Answer

Photograph the scene and document everything in a notebook.

Answer

Create a forensic image of the hard drive using a write blocker.

Question 9

A forensic examiner uses Oxygen Forensic Detective to acquire data from an Android device. The tool reports that it performed a 'full file system' extraction. Which of the following is a prerequisite for this type of extraction?

Accepted Answer

The device must be rooted. A full file system extraction in Oxygen Forensic Detective requires root access on the Android device because the tool must bypass the Linux kernel's permission model to read protected partitions (e.g., /data, /cache). Without root privileges, the extraction is limited to the logical or file-based scope, as the Android security model restricts user-space processes from accessing raw block devices or system files owned by root.

Answer

The bootloader must be unlocked

Answer

The device must be in recovery mode

Answer

USB debugging must be enabled

Question 10

A forensic examiner has acquired a disk image using FTK Imager and needs to ensure the image is an exact duplicate of the original drive. Which THREE of the following methods can be used to verify integrity? (Select THREE)

Accepted Answer

Compute the SHA-256 hash of the image and compare it to the original drive's hash. SHA-256 is a cryptographic hash function that produces a unique 256-bit digest. By computing the SHA-256 hash of the acquired image and comparing it to the hash computed from the original drive, the examiner can verify bit-for-bit integrity with extremely high collision resistance, ensuring the image is an exact duplicate.

Answer

Verify the cyclical redundancy check (CRC-32) of the image file

Answer

Check the file size of the image matches the original drive's capacity

Question 11

In Android forensics, which command is used to extract a full physical image of a device's flash memory over USB using the Android Debug Bridge (ADB)?

Accepted Answer

adb shell dd if=/dev/block/mmcblk0 of=/sdcard/physical.img. The `adb shell dd if=/dev/block/mmcblk0 of=/sdcard/physical.img` command uses the `dd` utility to perform a bit-for-bit copy of the raw block device representing the internal flash memory (mmcblk0) to a file on the device's SD card, which can then be pulled via ADB. This method captures a full physical image, including deleted data and unallocated space, which is essential for deep forensic analysis.

Answer

adb pull /data data.img

Answer

adb backup -f backup.ab

Answer

adb install physical.img

Question 12

You are responding to a suspected malware infection on a Windows 10 system. The system is still running. Which of the following should you collect FIRST?

Accepted Answer

Acquire a memory dump using a tool like WinPmem.. When a system is still running and suspected of malware infection, the first priority is to capture volatile data, which includes the contents of RAM. WinPmem is a tool designed to acquire a memory dump from a live Windows system, preserving critical evidence such as running processes, network connections, and injected code that would be lost on shutdown. This follows the order of volatility (RFC 3227), which mandates collecting memory before any non-volatile data like logs, registry, or disk images.

Answer

Collect the Windows Event Logs.

Answer

Export the contents of the Windows Registry.

Answer

Create a forensic image of the hard drive.

Question 13

During a forensic examination of a solid-state drive (SSD), the analyst notices that the TRIM command was enabled. What challenge does this pose for data recovery?

Accepted Answer

It erases data blocks immediately after deletion, preventing recovery. The TRIM command (ATA Data Set Management command) instructs the SSD controller to immediately erase the physical NAND blocks corresponding to deleted logical block addresses (LBAs). This proactive garbage collection operation resets the cells to an erased state, making it impossible for forensic tools to recover the original data from those blocks, as the data is physically overwritten with null values or marked as invalid.

Answer

It causes fragmentation, making file recovery more complex

Answer

It causes the drive to encrypt data automatically

Answer

It physically destroys the NAND cells, making the drive unusable

Question 14

During a forensic examination, an analyst uses the command 'dcfldd if=/dev/sda of=image.dd hash=sha256 hashlog=hash.txt'. What is the primary purpose of including 'hash=sha256' in this command?

Accepted Answer

To compute a SHA-256 hash of the input drive and log it to a file for integrity verification. The `hash=sha256` parameter in `dcfldd` instructs the tool to compute a SHA-256 hash of the input device (`/dev/sda`) during the acquisition process. This hash is then logged to the file specified by `hashlog=hash.txt`, providing a verifiable integrity check that the forensic image matches the original source. This is a standard forensic practice to ensure the image has not been altered or corrupted.

Answer

To split the image into multiple files named with SHA-256 checksums

Answer

To encrypt the output image file using SHA-256

Answer

To compress the image using SHA-256 compression algorithm

Question 15

What is the PRIMARY purpose of a chain of custody document in a forensic investigation?

Accepted Answer

To provide a chronological record of who handled the evidence, when, and why.. The chain of custody document is the foundational record that ensures evidence integrity and admissibility in court. Its primary purpose is to create a chronological, unbroken log of every person who handled the evidence, the exact time and date of each transfer, and the reason for the transfer. This directly supports the legal requirement to prove that the evidence has not been tampered with or altered from the moment of seizure to its presentation in court.

Answer

To document the tools used during the investigation.

Answer

To list all the files found on the suspect's computer.

Answer

To authorize the search and seizure of digital evidence.