CHFI Practice Test 29 — 15 Questions

Question 1

An organization receives a legal hold notice regarding pending litigation. The IT department is instructed to preserve all relevant electronically stored information. What is the primary action the IT department should take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place a hold on relevant data and suspend routine deletion policies. The primary action is to place a legal hold on relevant data and suspend routine deletion policies. This ensures that all potentially relevant electronically stored information (ESI) is preserved in its current state, preventing spoliation and compliance with the legal hold notice. Suspending deletion policies stops automated processes like email purge jobs or document retention schedules from destroying evidence, which is a foundational step in the e-discovery process.

Answer

Ignore the notice and continue normal operations

Answer

Create a forensic image of all servers immediately

Answer

Permanently delete all emails older than 30 days to reduce storage

Question 2

What is the primary purpose of the Host Protected Area (HPA) on a hard disk drive?

Accepted Answer

To store diagnostic data or allow vendors to hide data from the OS. HPA is a reserved area on the disk that is not visible to the operating system, intended for vendor-specific data. It can be used to hide data from forensic acquisition.

Answer

To provide a write-cache for improved performance

Answer

To store the partition table when using GPT

Answer

To store the operating system boot loader

Question 3

A Docker container is suspected of malicious activity. Which THREE data sources should the investigator collect for forensic analysis?

Accepted Answer

Host system audit logs. Container logs, image layers, and host system logs are key sources in Docker forensics.

Answer

Network packet captures from the container's virtual interface

Answer

The Dockerfile used to build the image

Question 4

A forensic analyst is investigating a Docker container that was used to launch a network attack. The container has been stopped but not removed. Which action should the analyst take FIRST to preserve volatile evidence?

Accepted Answer

Use 'docker commit' to create an image of the container. Preserving the container's file system and logs is key. 'docker commit' creates an image from the container's current state. 'docker export' exports the filesystem as a tar archive. 'docker logs' retrieves logs. 'docker inspect' shows metadata. The container is stopped, so 'docker exec' won't work without starting it, which alters state. 'docker save' saves images, not containers. The best first step is to create an image or export the filesystem.

Answer

Restart the container and use 'docker exec' to collect evidence

Answer

Use 'docker inspect' to view container metadata only

Answer

Use 'docker save' to export the container as a tar file

Question 5

During a forensic examination of an NTFS drive, an analyst runs 'fsutil usn readjournal C:' and observes a large number of USN journal entries for a specific file after a certain date. The file's $MFT record shows a last modified timestamp far earlier than the journal entries. What does this discrepancy suggest?

Accepted Answer

The file's metadata was modified without changing its content, possibly using timestomping or ADS manipulation. The USN journal records all changes to files and directories on an NTFS volume, including metadata modifications. When the USN journal shows numerous entries after a date but the $MFT record's last modified timestamp is earlier, it indicates that the file's metadata (e.g., timestamps, ADS) was altered without updating the $MFT's last modified field—a classic sign of timestomping or ADS manipulation. This discrepancy arises because timestomping tools can directly modify $MFT attributes while the USN journal still logs the change event.

Answer

The file is a system file that is excluded from USN journaling

Answer

The file system is corrupted and the MFT is not updating correctly

Answer

The file was accessed via a mounted volume shadow copy, which does not update MFT

Question 6

Which FOUR of the following are persistence mechanisms that can be used on Linux systems?

Accepted Answer

SSH authorized keys. Persistence mechanisms on Linux include SSH authorized keys (B), which allow an attacker to maintain remote access by adding their public key to the target user's authorized_keys file; startup scripts in /etc/init.d (C), which execute at boot; cron jobs (D), which run scheduled tasks; and modifications to /etc/passwd (E) to create persistent user accounts. Prefetch files (A) are Windows-specific and not a Linux persistence mechanism.

Answer

Prefetch files

Question 7

An investigator notes that a file on an NTFS volume has a resident data size of 900 bytes, but the $DATA attribute lists an allocated size of 1024 bytes. What does this indicate?

Accepted Answer

The file has slack space that may contain remnants of previously deleted data. On an NTFS volume, when a file's data is stored as a resident attribute within the MFT, the $DATA attribute's allocated size is typically 0 because the data occupies space only within the MFT record itself. Here, the allocated size is 1024 bytes, which is larger than the resident data size of 900 bytes. This indicates that the file is stored non-resident (i.e., in clusters outside the MFT), and the allocated size reflects the cluster size (e.g., 1024 bytes per cluster). The difference between the allocated size (1024 bytes) and the actual data size (900 bytes) is slack space, which may contain remnants of previously deleted data.

Answer

The file is compressed using NTFS compression

Answer

The file's data is stored in the MFT as a resident attribute

Answer

The file is stored in an alternate data stream

Question 8

Refer to the exhibit. A database administrator finds the above error log entries when attempting to start the MySQL service. The server was working fine yesterday. What is the most likely cause of this issue?

Accepted Answer

The InnoDB system tablespace file (ibdata1) is corrupted.. The error log entries indicate that InnoDB is unable to open or read the system tablespace file (ibdata1), which is the core file storing the InnoDB data dictionary, undo logs, and doublewrite buffer. A corrupted ibdata1 prevents MySQL from starting because the storage engine cannot initialize its internal structures, even if the server was operational the previous day. This matches the symptom of a sudden failure without prior configuration changes.

Answer

The MySQL user does not have write permissions to the data directory.

Answer

The binary log is full and cannot be rotated.

Answer

The server ran out of memory due to high innodb_buffer_pool_size.

Question 9

Refer to the exhibit. A first responder runs the netstat command on a compromised Windows workstation. Which of the following conclusions is BEST supported by the output?

Accepted Answer

A process with PID 1234 is likely communicating with a remote C2 server at 10.2.3.4.. An established TCP connection (ESTABLISHED state) from the workstation to a remote IP on a high ephemeral port (49152) with PID 1234 strongly indicates active communication. This is a classic indicator of a beaconing C2 channel, as legitimate outbound connections typically use well-known ports or are short-lived. The netstat output shows PID 1234 has a persistent connection to 10.2.3.4:4444, which is a common port for malware command and control.

Answer

The connection to 192.168.1.1:80 is suspicious because it is in TIME_WAIT state.

Answer

The UDP listener on port 5353 indicates a malware infection.

Answer

The workstation is running multiple virtual machines based on the local addresses.

Question 10

A forensic examiner needs to create a bit-for-bit copy of a suspect's hard drive for analysis. Which tool is specifically designed for this purpose and can also verify integrity using hashing?

Accepted Answer

dd. The `dd` command is a Unix/Linux utility that performs low-level bit-for-bit copying of storage devices, creating an exact forensic image (e.g., raw .dd or .img format). It can verify integrity by piping the output through a hashing tool like `md5sum` or `sha256sum`, or by using `dd` with `conv=noerror,sync` and later comparing hash values of the source and destination.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 11

An analyst is recovering deleted files from a FAT32 file system. The file system uses a cluster size of 4096 bytes. The first cluster of a deleted file is cluster 100. Which structure contains the chain of clusters for this file?

Accepted Answer

File Allocation Table (FAT). The File Allocation Table (FAT) is the core structure that stores the chain of clusters for files in FAT32 file systems. When a file is deleted, its directory entry is marked as available, but the FAT entries for its clusters (starting at cluster 100) remain intact until overwritten, allowing recovery by following the cluster chain in the FAT.

Answer

Volume boot record

Answer

Directory entry

Answer

Boot sector

Question 12

During a forensic analysis of a compromised web server, an investigator identifies the following log entries. Which THREE entries are the strongest indicators of a successful web shell upload? (Choose three.)

Accepted Answer

POST /upload.php HTTP/1.1 200 0. Successful uploads of aspx or php files that contain web shell code (e.g., with cmd parameter) and subsequent access to those files are strong indicators. The 404 for cmd.exe indicates a path traversal attempt, not a web shell.

Answer

GET /../../windows/system32/cmd.exe HTTP/1.1 404 - -

Answer

GET /images/logo.png HTTP/1.1 304 - -

Question 13

An analyst finds the following string in an IIS log: %3Cscript%3Ealert('XSS')%3C/script%3E. What does this indicate?

Accepted Answer

A cross-site scripting (XSS) attempt. The string is URL-encoded HTML/JavaScript (). It is a typical cross-site scripting payload attempting to execute in a browser.

Answer

A SQL injection attempt

Answer

A buffer overflow attempt

Answer

A path traversal attempt

Question 14

An analyst is examining a PCAP file in Wireshark and notices a series of TCP SYN packets sent to multiple ports on a single IP address, with no subsequent SYN-ACK replies. What type of network activity does this indicate?

Accepted Answer

A port scan attempting to identify open ports. Sending SYN packets to many ports without receiving SYN-ACKs indicates a port scan, likely a TCP SYN scan, to discover open ports.

Answer

A denial of service attack

Answer

A man-in-the-middle attack

Answer

A TCP handshake for normal connection establishment

Question 15

A security analyst notices repeated entries in an IIS log: 10.0.0.2, -, 05/Feb/2023:08:12:34 +0000, GET /../../windows/system32/config/sam, 404, 0, 532. Which TWO of the following attack types are indicated by this log entry?

Accepted Answer

Directory traversal. The use of '../' indicates path traversal, and the target file (SAM) is a common target for privilege escalation.

Answer

SQL injection

Answer

Denial of service

Answer

Cross-site scripting