CHFI Practice Test 3 — 10 Questions

Question 1

An expert witness is preparing to testify in a computer forensics case. Which of the following is a key requirement for the expert's testimony to be admissible under the Daubert standard?

Accepted Answer

The expert's techniques must be based on reliable principles and methods. Under the Daubert standard, the admissibility of expert testimony hinges on whether the expert's techniques are based on reliable principles and methods, not merely on general acceptance. This standard, established in Daubert v. Merrell Dow Pharmaceuticals, requires the trial judge to act as a gatekeeper, evaluating the scientific validity and reliability of the methodology used. In computer forensics, this means the expert must demonstrate that their acquisition, preservation, and analysis methods (e.g., using write-blockers, cryptographic hashing like SHA-256, and chain-of-custody documentation) are scientifically sound and consistently applied.

Answer

The expert's methods must be generally accepted in the scientific community

Answer

The expert must have personally examined all evidence

Answer

The expert must have a law degree

Question 2

During a forensic investigation, you need to acquire the RAM of a running Linux system. Which tool is specifically designed for memory acquisition on Linux?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is the correct tool because it is specifically designed to capture volatile memory (RAM) from Linux systems, loading as a loadable kernel module (LKM) to dump memory contents to a file or over the network. Unlike generic tools, LiME handles kernel address space layout randomization (KASLR) and can acquire memory without altering the system state, making it the standard for Linux forensic memory acquisition.

Answer

Memdump

Answer

Volatility

Answer

WinPmem

Question 3

A security analyst reviewing Windows Security Event Logs sees multiple Event ID 4625 entries for a single user account, followed by a successful Event ID 4624. The account is a domain administrator. What is the MOST likely explanation?

Accepted Answer

An attacker performed a brute-force password attack and succeeded. Event ID 4625 indicates a failed logon attempt, while Event ID 4624 indicates a successful logon. A sequence of multiple 4625 events for the same domain administrator account followed by a single 4624 event is the classic signature of a successful brute-force password attack, where an attacker systematically tries passwords until one works. The fact that the account is a domain administrator makes it a high-value target, and the pattern of failures then success is inconsistent with simple user error or misconfiguration.

Answer

The user typed their password incorrectly several times before succeeding

Answer

The system experienced a denial of service attack

Answer

A misconfigured application caused repeated logon attempts

Question 4

During a Windows forensic investigation, an analyst finds prefetch files with the .pf extension. Which TWO pieces of information can the analyst obtain from analyzing prefetch files?

Accepted Answer

The number of times the application has been executed. Prefetch files in Windows store execution count and timestamps of application launches. The .pf file header contains a run count field that increments each time the application is executed, and the file also records up to eight previous execution timestamps. This allows the analyst to determine how many times the application was run and the exact date and time of each execution, making A and B correct.

Answer

The username that executed the application

Answer

The command-line arguments used to launch the program

Answer

The IP addresses the application connected to

Question 5

Which THREE of the following are types of slack space that can contain hidden data on a hard disk?

Accepted Answer

File slack. File slack (C) is correct because it refers to the unused space between the end of a file's data and the end of the allocated cluster. This area can contain remnants of previous file data or intentionally hidden data, and is a standard forensic artifact in file system analysis (e.g., NTFS or FAT).

Answer

Device Configuration Overlay

Answer

Host Protected Area

Question 6

Which TWO Windows Event IDs are associated with successful logon or explicit credential usage? (Choose TWO.)

Accepted Answer

4648. Event ID 4648 is logged when a user attempts to log on using explicit credentials, such as running a program as a different user or using the 'runas' command. Event ID 4624 is logged for every successful local or remote logon session, including interactive, network, and service logons. Both are standard Windows Security log events used in forensic analysis to track authentication activity.

Answer

4720

Answer

4625

Answer

7045

Question 7

In mobile forensics, which acquisition method preserves the highest level of data integrity and captures the most data from an iOS device?

Accepted Answer

Physical acquisition. Physical acquisition is correct because it creates a bit-for-bit copy of the entire flash storage, including unallocated space, deleted files, and system partitions. This method bypasses the iOS file system abstraction, preserving the highest data integrity and capturing all recoverable data, unlike higher-level acquisitions that only retrieve accessible files.

Answer

File system acquisition

Answer

Logical acquisition

Answer

Manual acquisition

Question 8

During a forensic analysis of an NTFS volume, an investigator finds a file that appears to be hidden. Which NTFS feature allows data to be stored in a file without affecting the file's visible size in the directory listing?

Accepted Answer

Alternate Data Streams (ADS). Alternate Data Streams (ADS) allow additional data to be attached to a file on an NTFS volume without altering the file's main data stream or its visible size in directory listings. This is possible because NTFS organizes file data into multiple streams; the default $DATA stream holds the visible content, while additional named streams can store hidden data. Tools like `dir` or Windows Explorer only report the size of the unnamed $DATA stream, making ADS an effective method for concealing data.

Answer

Volume Shadow Copy

Answer

USN Journal

Answer

Master File Table ($MFT)

Question 9

You are a forensic analyst investigating a suspected malware infection on a Windows 10 workstation. The user reports that the system has been slow and that unexpected pop-ups appear. You have acquired a memory dump and a disk image. During analysis, you find a suspicious process named 'svch0st.exe' running with PID 4567. The process has loaded several DLLs, including 'wininet.dll' and 'ws2_32.dll'. You also find that the process has an active TCP connection to an external IP address 203.0.113.5 on port 4444. In the disk image, you find an executable file at C:\Users\Public\svch0st.exe with a creation date that matches the start of symptoms. The file's hash is not in any known malware database. You decide to perform dynamic analysis by running the file in a sandbox. However, the sandbox environment has no network connectivity. The executable runs but does not exhibit any malicious behavior. What should you do next to determine if the file is malicious?

Accepted Answer

Re-run the sample in a sandbox with simulated network connectivity or a controlled network to observe C2 communication. The sandbox lacked network connectivity, which prevented the malware from reaching its command-and-control (C2) server. Many malware samples, especially those using HTTP or raw TCP for C2, will remain dormant or exhibit no malicious behavior when they cannot connect to the external IP. By providing simulated or controlled network connectivity, you can trigger the malicious payload and observe the actual C2 communication, confirming the file's intent.

Answer

Conduct a thorough static analysis using a disassembler and debugger to understand the code

Answer

Delete the suspicious file and run a full antivirus scan on the system

Answer

Perform a forensic imaging of the system again and compare with the original image

Question 10

During an investigation, an analyst recovers a file from unallocated space that contains fragments of a deleted document. The file size is 512 bytes, but the cluster size of the volume is 4096 bytes. What is the term for the unused bytes between the end of the file and the end of the last cluster?

Accepted Answer

File slack. File slack refers to the unused bytes between the end of a file and the end of the last cluster allocated to that file. In this scenario, the file is 512 bytes but resides in a 4096-byte cluster, leaving 3584 bytes of slack space. This area can contain remnants of previously deleted data or metadata, making it a critical forensic artifact.

Answer

Volume slack

Answer

Drive slack

Answer

RAM slack