CHFI Practice Test 29 — 15 Questions

Question 1

A forensic analyst is investigating a compromised Linux server running an ext4 file system. The analyst suspects the attacker deleted critical log files (e.g., /var/log/auth.log) and wants to recover them. Which TWO techniques would be MOST effective for recovering the deleted files?

Accepted Answer

Running `extundelete` on the partition. For ext4, deleted file recovery can be achieved by scanning the journal for recent file metadata, or by carving the raw disk for file signatures. The inode pointers are cleared upon deletion, but journal may contain recent records.

Answer

Checking the `.Trash-1000` folder

Answer

Restoring from the `lost+found` directory

Answer

Executing `dd if=/dev/sda1 of=image.dd` and analyzing with `strings`

Question 2

An analyst is examining a Windows 10 system and suspects the use of NTFS alternate data streams (ADS) to hide malicious executables. Which THREE methods can the analyst use to detect hidden ADS on the system?

Accepted Answer

Checking the $MFT for $DATA attributes where the attribute name is not empty. ADS can be detected by using tools that list streams (like streams.exe or dir /r), checking the $MFT for $DATA attributes with a non-empty name, or scanning for known malicious ADS names with forensic tools.

Answer

Comparing file sizes from `dir` output with raw disk sector counts

Answer

Running `sfc /scannow` to verify system file integrity

Question 3

During a forensic analysis of a compromised Linux server, you notice that the file /var/log/auth.log has been cleared. However, you find that the attacker's commands are still partially recoverable. Which artifact most likely contains the attacker's command history?

Accepted Answer

~/.bash_history. The bash_history file for each user (typically ~/.bash_history) stores command-line history. Even if auth.log is cleared, this file often retains command entries.

Answer

/var/log/syslog

Answer

/proc/1/cmdline

Answer

/etc/shadow

Question 4

A network analyst is reviewing a packet capture and sees a large number of TCP SYN packets sent to various ports on a single host from multiple source IPs. This pattern is most indicative of which type of attack?

Accepted Answer

SYN flood. A SYN flood sends many SYN packets without completing the handshake, overwhelming the target. The source IPs may be spoofed.

Answer

ARP spoofing

Answer

DNS amplification

Answer

Ping of death

Question 5

A forensic examiner is analyzing a compromised Linux server and notices that /etc/cron.daily contains a script named 'sysupdate.sh' that runs a base64-encoded command. Which persistence mechanism is being used?

Accepted Answer

Cron job for daily execution. Cron jobs in /etc/cron.daily are scheduled tasks that run daily. Malicious scripts placed there provide persistence by re-executing at regular intervals.

Answer

LD_PRELOAD library injection

Answer

Systemd service

Answer

SSH authorized_keys backdoor

Question 6

A forensic analyst is investigating a Windows system for persistence mechanisms. Which TWO registry locations are commonly used by malware to achieve auto-start? (Select TWO.)

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Run keys under HKLM and HKCU are common autorun locations used by malware to start on boot or user login.

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKLM\SAM\SAM

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Question 7

A forensic analyst is examining a Windows system and finds that the UserAssist key in the NTUSER.DAT hive contains entries with Rot13-encoded names. What is the primary purpose of the UserAssist key?

Accepted Answer

Log program execution counts and last run times. UserAssist tracks application execution count and last run time. The Rot13 obfuscation is to hide the names from casual viewing.

Answer

Record USB device connection history

Answer

Store user password history

Answer

Track recently opened documents via Jump Lists

Question 8

An analyst suspects that an attacker used a web shell to execute commands on a Windows web server. Which Windows event ID should the analyst look for to detect service installation that may have been used for persistence?

Accepted Answer

7045. Event ID 7045 indicates a service was installed on the system, which attackers often use to maintain persistence.

Answer

4624

Answer

4648

Answer

4720

Question 9

Which of the following Windows registry keys is commonly used by malware to achieve persistence by executing a program at user logon?

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. The Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a common persistence location; it runs the specified program when the user logs in.

Answer

HKEY_LOCAL_MACHINE\SAM\SAM

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Question 10

An attacker has compromised a Linux server and edited the /etc/passwd file to change a user's UID to 0. What is the likely goal of this modification?

Accepted Answer

To escalate privileges to root. UID 0 is the root user. Changing a user's UID to 0 grants that user root privileges, providing privileged access.

Answer

To lock the user account

Answer

To enable password-less login

Answer

To hide the user account from the system

Question 11

A forensic analyst discovers an unusual entry in the Windows Registry under 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run'. Which persistence mechanism does this represent?

Accepted Answer

Registry Run key persistence. The Run key is a standard location for programs to auto-start when a user logs on. A malicious entry here indicates persistence via registry run keys.

Answer

Service installation

Answer

Scheduled task

Answer

Startup folder

Question 12

A network forensic analyst examines a pcap file in Wireshark and sees an HTTP POST request to '/shell.jsp' with a parameter 'cmd' containing 'dir'. The response contains a directory listing. Which intrusion artifact is indicated?

Accepted Answer

Webshell. A webshell is a malicious script that provides remote command execution via web requests. The POST to a JSP file with a cmd parameter and directory listing in the response indicates a webshell.

Answer

SQL injection

Answer

Directory traversal

Answer

Cross-site scripting (XSS)

Question 13

A forensic examiner is analyzing a Mac system and wants to review system logs that record various activities, including application launches and kernel events. Which logging system on macOS should be examined?

Accepted Answer

Unified logging (log command). Unified logging (via log command) captures system and user activity in a centralized database, replacing traditional syslog.

Answer

.plist files

Answer

FSEvents

Answer

Console.app logs

Question 14

Which network forensic technique involves analyzing the flow of network traffic to identify patterns and anomalies, often using tools like SiLK or nfdump?

Accepted Answer

NetFlow analysis. NetFlow analysis examines flow records (e.g., IPFIX, NetFlow) to understand traffic patterns, volumes, and anomalies, using tools like SiLK or nfdump.

Answer

Port scanning

Answer

Signature-based detection

Answer

Deep packet inspection

Question 15

A security analyst investigates a Windows system and finds an event with ID 4625 in the Security log. What does this event indicate?

Accepted Answer

A failed logon attempt. Event ID 4625 indicates a failed logon attempt. This is a standard Windows security event used to track authentication failures.

Answer

A successful user logon

Answer

A service was installed

Answer

A new user account was created