CHFI Practice Test 28 — 15 Questions

Question 1

In an email header, which field typically contains the IP address of the original sending client?

Accepted Answer

Received. The 'Received' field in an email header is added by each mail transfer agent (MTA) that processes the message, and the first 'Received' header (at the bottom of the header block) typically contains the IP address of the original sending client (the SMTP client that initiated the connection). This field records the 'from' IP and the 'by' host, making it the definitive source for tracing the origin of the email.

Answer

Return-Path

Answer

Message-ID

Answer

DKIM-Signature

Question 2

Which tool is commonly used in timeline analysis for digital forensics to parse various artifacts and create a super timeline?

Accepted Answer

log2timeline / Plaso. log2timeline (now part of the Plaso framework) is specifically designed to parse a wide variety of digital forensic artifacts—such as Windows Event Logs, Prefetch files, registry hives, and browser history—and aggregate them into a single, unified super timeline. This super timeline allows investigators to correlate events across different data sources and identify sequences of activity with precise timestamps, which is essential for timeline analysis in OS and network forensics.

Answer

Volatility

Answer

Wireshark

Answer

Sleuth Kit

Question 3

What is the primary purpose of maintaining a chain of custody during a forensic investigation?

Accepted Answer

To document the handling of evidence from collection to presentation in court. The primary purpose of maintaining a chain of custody is to create a documented, unbroken record of every person who handled the evidence, from the moment it is collected until it is presented in court. This documentation is critical to establish the authenticity and integrity of the evidence, ensuring it has not been tampered with or altered, which is a foundational requirement for admissibility under legal standards like the Federal Rules of Evidence (FRE) 901. Without a proper chain of custody, the evidence can be challenged as inadmissible due to lack of trustworthiness.

Answer

To reduce the size of evidence for easier storage

Answer

To analyze the evidence for hidden data

Answer

To encrypt the evidence to prevent unauthorized access

Question 4

During a forensic investigation of a compromised web server, an analyst examines the Apache access log and finds the following entry: '192.168.1.10 - - [12/Oct/2024:13:45:22 +0000] "GET /index.php?id=1 UNION SELECT username, password FROM users-- HTTP/1.1" 200 1234 "-" "Mozilla/5.0"'. What type of attack is MOST likely indicated?

Accepted Answer

SQL injection (SQLi). The log entry shows a UNION-based SQL injection attempt, where the attacker appends 'UNION SELECT username, password FROM users--' to the 'id' parameter in the GET request. This manipulates the original SQL query to return sensitive data from the 'users' table, which is the hallmark of SQL injection (SQLi). The HTTP 200 response indicates the query executed successfully, confirming the attack vector.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Remote file inclusion (RFI)

Question 5

During an internal investigation, an employee is suspected of leaking sensitive data. The security team finds that the employee's computer has been turned off. Which of the following evidence types would be LOST due to the system being powered off?

Accepted Answer

Contents of RAM and network connections. When a system is powered off, the contents of volatile memory (RAM) are immediately lost because RAM requires constant electrical power to retain data. Similarly, active network connections are terminated and their state is lost, as they are maintained in kernel memory structures that are not persisted to disk. Therefore, any evidence residing only in RAM (e.g., encryption keys, running processes, unencrypted data) or transient network session details (e.g., active TCP/UDP connections, IP addresses) is permanently lost upon shutdown.

Answer

System logs stored in the Event Viewer

Answer

Files stored on the hard drive

Answer

Registry hives

Question 6

A malware analyst is examining a suspicious Windows executable. Running 'strings' reveals references to 'C:\Windows\System32\drivers\etc\hosts' and IP addresses 185.130.5.21 and 192.168.1.1. Dynamic analysis in a sandbox shows the binary modifies the hosts file and creates a mutex named 'Global\Mtx_Update'. Which behavioral indicator is MOST clearly associated with persistence?

Accepted Answer

Modifying the hosts file with an entry for 192.168.1.1. Modifying the hosts file to redirect a legitimate domain to 192.168.1.1 is a classic persistence mechanism: the malware ensures that every time the system resolves that domain, it points to the attacker-controlled IP, effectively hijacking network traffic persistently across reboots without needing to run at startup. This behavior directly maintains unauthorized control over name resolution, which is a hallmark of persistence.

Answer

Connecting to IP 185.130.5.21 on port 443

Answer

Writing temporary files to %TEMP%

Answer

Creating the mutex 'Global\Mtx_Update'

Question 7

An organization uses Microsoft SQL Server 2019 with full recovery model. A database administrator accidentally executed a DROP TABLE statement. The transaction log was backed up immediately after the incident. Which forensic technique would allow the analyst to restore the dropped table?

Accepted Answer

Perform a tail-log backup, then restore the full backup and all subsequent transaction log backups, stopping before the DROP TABLE.. Under the full recovery model, point-in-time recovery is required to undo the DROP TABLE. By performing a tail-log backup (to capture any transactions after the last log backup), then restoring the full backup and all subsequent transaction log backups with STOPAT or STOPBEFOREMARK to the moment just before the DROP TABLE, the analyst can recover the table without losing other transactions. This is the only method that preserves the dropped table's data while maintaining database consistency.

Answer

Restore the transaction log backup taken after the DROP TABLE and apply it to the database.

Answer

Use the RESTORE LOG statement with the NO_TRUNCATE option to recover the table.

Answer

Restore the most recent full backup and ignore subsequent transaction log backups.

Question 8

An investigator is analyzing a Windows 10 system suspected of malware persistence. Which registry key is commonly used by malware to achieve persistence by running a program at every user logon?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard autostart location that Windows checks at every user logon. Malware commonly writes a value here pointing to its executable path, ensuring it runs automatically each time the user logs into their account. This is a well-documented persistence mechanism in Windows forensics.

Answer

HKLM\SAM\SAM

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall

Question 9

Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?

Accepted Answer

It is a virtual directory that contains files with no parent directory, often from deleted files. In The Sleuth Kit (TSK), the 'fls' command lists files and directories within a disk image. The entry 'V/V 113-128-1: $OrphanFiles' is a virtual directory that contains files that have no parent directory in the file system, typically because their directory entries were deleted or corrupted. This is a common artifact when recovering deleted files from NTFS volumes, as TSK collects such orphaned MFT entries into this virtual container.

Answer

It is a sign that a rootkit has hidden files in the image

Answer

It indicates the location of the Master File Table (MFT) mirror

Answer

It is a standard NTFS metadata file that stores file permissions

Question 10

Which of the following is a unique challenge in cloud forensics compared to traditional digital forensics?

Accepted Answer

Multi-tenancy and data isolation. In cloud forensics, multi-tenancy and data isolation present a unique challenge because multiple customers share the same physical infrastructure, and forensic investigators must ensure that data acquisition from one tenant does not inadvertently expose or contaminate another tenant's data. This requires careful coordination with the cloud provider to isolate logical boundaries, often using techniques like snapshot-based acquisition or API-driven evidence collection, which are not typical in traditional single-owner digital forensics.

Answer

Encryption of data at rest

Answer

Lack of network connectivity

Answer

Inability to acquire disk images

Question 11

During a Windows forensic analysis, you find a suspicious LNK file in a user's Recent folder. Which of the following is NOT typically retrievable from an LNK file?

Accepted Answer

Username of the user who created the LNK file. LNK files store metadata about the target file and the system environment, but they do not record the username of the user who created the LNK file. The creation timestamp of the LNK file itself is stored, but the username is not part of the LNK file structure. Instead, the username context is inferred from the user's profile folder path where the LNK resides, not from the file's internal data.

Answer

Target file creation timestamp

Answer

Volume serial number of the target drive

Answer

Target file path

Question 12

A security analyst observes multiple Event ID 4625 logon failures for a single user account within a short time frame, followed by Event ID 4624 logon success. Which attack technique is MOST likely indicated?

Accepted Answer

Brute-force or password spraying attack. Event ID 4625 indicates failed logon attempts, and Event ID 4624 indicates a successful logon. A rapid sequence of failures followed by a success for the same user account is the classic signature of a brute-force or password spraying attack, where an attacker tries multiple passwords until one works. This pattern is specific to authentication attempts against the local SAM or domain controller via NTLM or Kerberos, not to post-authentication attacks.

Answer

Kerberos golden ticket attack

Answer

SQL injection attack on the authentication database

Answer

Pass-the-hash attack

Question 13

During an incident response, a first responder needs to collect evidence from a Linux server that is still running. The server has sensitive data and cannot be shut down. Which technique is BEST for acquiring a forensic image of the hard disk?

Accepted Answer

Use dd if=/dev/sda of=/mnt/evidence/image.dd bs=4M. It uses dd with a 4M block size, which improves acquisition speed while still producing a bit-for-bit forensic image of the entire disk (/dev/sda). The conv=noerror,sync option in A is unnecessary for a live acquisition from a healthy disk and can mask read errors, while B's larger block size is more efficient for imaging a running system without shutdown.

Answer

Use dd if=/dev/sda of=/mnt/evidence/image.dd conv=noerror,sync

Answer

Use dd if=/dev/mapper/root of=/mnt/evidence/image.dd

Answer

Use dd if=/dev/sda1 of=/mnt/evidence/image.dd

Question 14

A security analyst detects a sudden spike in failed logon events with Event ID 4625 on a Windows domain controller. The source IP addresses are random and from various external subnets. Which type of attack is MOST likely occurring?

Accepted Answer

Brute‑force attack. Event ID 4625 indicates a failed logon attempt. A sudden spike from random, external source IPs is characteristic of a brute-force attack, where an attacker systematically tries many username/password combinations against the domain controller. This pattern does not match the stealthier or more targeted nature of the other attack types.

Answer

Pass‑the‑hash attack

Answer

Kerberos ticket forgery (Golden Ticket)

Answer

Insider threat with compromised credentials

Question 15

Which of the following is a key requirement for digital evidence to be considered admissible in court?

Accepted Answer

The evidence must be authentic and its integrity must be verifiable. Digital evidence must be authentic and its integrity verifiable to meet the legal standard of admissibility, as established by rules such as the Federal Rules of Evidence (FRE 901) and the Daubert standard. Authentication requires proving that the evidence is what it claims to be, typically through a hash value (e.g., MD5, SHA-1, or SHA-256) computed before and after analysis to ensure no tampering occurred. Without verifiable integrity, the evidence could be challenged as altered, making it inadmissible regardless of how it was collected.

Answer

The evidence must have been collected by a law enforcement officer

Answer

The evidence must be stored on a write-blocked device

Answer

The evidence must be encrypted to ensure confidentiality