CHFI Practice Test 30 — 15 Questions

Question 1

Which THREE of the following are challenges specific to forensic analysis of solid-state drives (SSDs) compared to traditional hard disk drives? (Select 3)

Accepted Answer

TRIM command may permanently erase deleted data. Option A is correct because the ATA TRIM command (and SCSI UNMAP) tells the SSD controller which LBAs are no longer in use, allowing those flash pages to be erased during idle garbage collection, so deleted data may be irrecoverably gone rather than merely unallocated as on an HDD. Option D is correct because garbage collection operates autonomously in the background, erasing whole flash blocks that still contain remnants of deleted files, so evidence can disappear between the time of seizure and acquisition. Option E is correct because wear leveling transparently relocates logical blocks to different physical NAND pages to spread erase cycles, breaking the fixed LBA-to-physical-sector mapping that forensic tools rely on and complicating file-system and deleted-file reconstruction. Option B is wrong because SSDs use NAND flash memory, not magnetic platters, so degaussing is inapplicable (and would not affect flash). Option C is wrong because SSDs have no rotating platters or actuator arms, so rotational latency is not a factor; they are generally faster to image than HDDs.

Answer

SSDs have platters that can be degaussed to destroy data

Answer

SSDs are slower to image because of rotational latency

Question 2

Which of the following email headers is used to verify the domain of the sending server and is commonly used for authentication to prevent spoofing?

Accepted Answer

DKIM-Signature. DKIM-Signature is the correct answer because it is an email authentication method that uses a digital signature to verify the domain of the sending server. It allows the receiver to check that the email was not forged or altered during transit, directly preventing domain spoofing. This header is defined in RFC 6376 and is a core component of email authentication frameworks like DMARC.

Answer

Content-Type

Answer

Received

Answer

X-Mailer

Question 3

Which THREE of the following are common indicators of a web shell on a compromised web server? (Select THREE.)

Accepted Answer

Files with obfuscated code (e.g., base64 encoded strings). Option B is correct because web shells are frequently hidden by obfuscating their PHP/JSP/ASP code with base64-encoded strings, gzinflate, eval, or similar encoding tricks to evade signature-based detection. Option C is correct because attackers commonly drop web shell files into writable, web-accessible directories such as /uploads or /images and set execute permissions so the web server can run them via HTTP. Option E is correct because a web shell typically receives commands through HTTP POST requests carrying unusually large or repeated payloads to a single script, which is a strong behavioral indicator in access logs. Option A is not a reliable indicator, since .htaccess files with rewrite rules are a normal, legitimate part of Apache configuration and are used for many benign purposes. Option D is not a reliable indicator either, because a high number of 404 errors usually reflects broken links, scanning noise, or misconfiguration rather than a web shell specifically.

Answer

Presence of .htaccess files with rewrite rules

Answer

High number of 404 errors in access logs

Question 4

Which TWO Windows Event IDs are associated with successful and failed logon events? (Select two.)

Accepted Answer

4625. Event ID 4625 [CORRECT] is the Security log entry generated when a logon attempt fails, recording details such as the account name, logon type, and failure reason, so it directly answers the failed-logon half of the question. Event ID 4624 [CORRECT] is the Security log entry generated when a logon attempt succeeds, capturing the new logon's account, logon type, and authentication package, so it answers the successful-logon half. Together these two IDs are the canonical pair for tracking successful and failed interactive, network, and service logons. The other options do not belong: 4720 is logged when a user account is created, 7045 is a System log entry recording a new service being installed, and 4648 records a logon attempt using explicit credentials (such as RunAs), not a standard success or failure logon event.

Answer

4720

Answer

7045

Answer

4648

Question 5

Which TWO of the following are tools commonly used for network forensics analysis? (Select two.)

Accepted Answer

tcpdump. tcpdump (A) is a command-line packet capture and analysis tool that uses libpcap to intercept and decode live network traffic, making it a staple for network forensics. Wireshark (E) is the de facto GUI protocol analyzer that captures packets and provides deep dissection of hundreds of protocols, so it is also a core network forensics tool. By contrast, Autopsy (B) is a disk/image forensics platform for file system and artifact analysis, Volatility (C) is a memory forensics framework for RAM dumps, and dd (D) is a low-level imaging/duplication utility — none of these are primarily used to capture or analyze network traffic.

Answer

Autopsy

Answer

Volatility

Answer

dd

Question 6

A forensic analyst is examining a network packet capture for signs of data exfiltration. Which THREE of the following are common indicators of data exfiltration over DNS? (Select three.)

Accepted Answer

DNS responses with unusually large payloads (e.g., TXT records). Option C is correct because DNS tunneling tools such as iodine and dnscat2 encode stolen data in TXT, NULL, or CNAME records, producing responses far larger than the typical 512-byte UDP DNS limit and thus a strong exfiltration indicator. Option D is correct because exfiltration over DNS requires many queries to carry data out, so a high volume of queries to a single domain (often thousands per hour) stands out against normal resolver traffic. Option E is correct because the encoded payload is placed in the leftmost label, generating long, random-looking subdomains such as 'aGVsbG8.evil.com' that are characteristic of DNS tunneling. Option A is not a reliable indicator: low TTLs are common in fast-flux and load-balancing setups and are not specific to exfiltration. Option B is also not specific, since clients legitimately query multiple configured or fallback DNS servers during normal resolution.

Answer

Low TTL values in DNS responses

Answer

DNS queries sent to multiple different DNS servers

Question 7

Which TWO of the following are persistence mechanisms commonly found in Windows forensics? (Select two.)

Accepted Answer

Scheduled Tasks. Scheduled Tasks (C) are a well-known Windows persistence mechanism because an attacker can register a task via schtasks.exe or the Task Scheduler that launches malware at logon, on a schedule, or on system events, and these tasks survive reboots. Registry Run keys (E), such as HKLM\Software\Microsoft\Windows\CurrentVersion\Run and HKCU equivalents, are classic autostart locations that execute listed programs at user logon, making them a common persistence technique. By contrast, Jump lists (A) are artifacts recording recently accessed files and applications for forensic reconstruction, not autostart mechanisms. ShellBags (B) store folder view settings and window preferences in the registry to show user navigation history, and Prefetch files (D) are performance artifacts in C:\Windows\Prefetch that record executed program traces, neither of which causes programs to run automatically at startup.

Answer

Jump lists

Answer

ShellBags

Answer

Prefetch files

Question 8

Which THREE of the following are commonly used network forensic data sources?

Accepted Answer

NetFlow logs. NetFlow logs (A) are a core network forensic source because routers and switches export flow records containing metadata such as source/destination IP, ports, protocol, byte/packet counts, and timestamps, enabling traffic pattern and anomaly analysis without full payload capture. IDS/IPS alerts (C) are network forensic data because they record detections of malicious or policy-violating traffic (e.g., Snort/Suricata signatures, anomaly events) with associated IPs, ports, and timestamps that support incident reconstruction. Packet captures (D) are the richest network forensic source, preserving full packet payloads at layers 2–7 (typically stored as PCAP/PCAPNG via tools like Wireshark or tcpdump) for protocol-level and content analysis. Prefetch files (B) and Windows registry hives (E) are host-based artifacts stored on the endpoint's filesystem, not network traffic data sources, so they do not belong in this list.

Answer

Prefetch files

Answer

Windows registry hives

Question 9

A forensic examiner is analyzing a Linux system suspected of being used as a C2 server. Which THREE artifacts should the examiner prioritize to find evidence of command execution and persistence? (Select three.)

Accepted Answer

~/.bash_history. Option A, ~/.bash_history, is correct because it records the interactive commands executed by a user's Bash shell, which can reveal attacker commands used to establish or operate C2 functionality. Option D, /var/log/auth.log, is correct because on Debian-based Linux systems it captures authentication events such as SSH logins, sudo usage, and failed login attempts, which help trace unauthorized access and privilege escalation tied to persistence. Option E, /etc/crontab, is correct because it is a system-wide cron table where scheduled jobs can be added by attackers to maintain persistence and periodically re-execute malicious commands. Option B, /var/log/syslog, is not among the marked answers because although it contains general system messages, it is less directly focused on command execution and persistence than the selected artifacts. Option C, /etc/passwd, is not among the marked answers because it primarily lists local user accounts and does not by itself provide evidence of command execution or persistence mechanisms.

Answer

/var/log/syslog

Answer

/etc/passwd

Question 10

A security analyst is investigating a potential webshell on an IIS server. Which THREE artifacts are commonly associated with webshell presence?

Accepted Answer

Presence of encoded scripts in the web application directory. Option B is correct because webshells are typically dropped as script files (e.g., .asp, .aspx, .php) in web-accessible directories, and attackers frequently obfuscate or encode them (Base64, gzip, eval/execute blocks) to evade signature detection. Option D is correct because webshell interaction occurs over HTTP, so IIS logs commonly show anomalous POST requests to .asp/.aspx endpoints, often with unusual user agents, parameters, or response sizes indicating command execution. Option E is correct because IIS worker process w3wp.exe spawning cmd.exe or powershell.exe is a classic parent-child anomaly indicating remote command execution through a webshell. Option A is not specific to webshells, since NetFlow to a legitimate update server is normal patching traffic and lacks host-level context. Option C is not indicative either, as Event ID 4624 logons by a service account are routine and do not by themselves evidence webshell activity.

Answer

Increase in NetFlow traffic to a known good update server

Answer

Event ID 4624 logon events from the service account

Question 11

An analyst is reviewing firewall logs and sees repeated outbound connections from an internal host to a known malicious IP on port 443. Which TWO network forensic data sources would BEST help determine if data exfiltration occurred?

Accepted Answer

Full packet capture (PCAP) of the sessions. Option B (Full packet capture (PCAP) of the sessions) is correct because PCAP records the actual bytes of each TCP session on port 443, allowing an analyst to inspect payloads, TLS handshake metadata, certificate details, and transferred content to confirm whether sensitive data left the host. Option E (Proxy logs with TLS interception and decrypted content) is correct because a TLS-intercepting proxy terminates the outbound TLS connection, decrypts the HTTP/HTTPS traffic, and logs URLs, methods, request/response bodies, and uploaded data, which directly reveals exfiltration over 443. Option A is not among the marked correct answers: flow records only show metadata such as byte/packet counts and timing, which can suggest large transfers but cannot confirm exfiltration content. Option C is not marked correct because IDS signature alerts indicate suspicious activity but do not by themselves prove that data was exfiltrated. Option D is not marked correct because Windows security event logs focus on host authentication, account, and policy events rather than the contents or destinations of outbound TLS sessions.

Answer

Network flow records showing packet sizes and counts

Answer

IDS alerts for signatures

Answer

Windows security event logs

Question 12

Which THREE of the following are challenges specific to container forensics?

Accepted Answer

Ephemeral nature of containers: containers are often short-lived and can be deleted quickly. Option A is correct because containers are frequently ephemeral—they can be stopped, deleted, or replaced in seconds—so volatile evidence such as running processes, memory, and writable layer data may disappear before acquisition, making timely capture critical. Option D is correct because a container image is built from stacked layers (e.g., in OCI/Docker format), and each layer may contain distinct artifacts, deleted files, or modifications, so investigators must analyze every layer rather than just the final filesystem view. Option E is correct because containers share the host's kernel via namespaces and cgroups rather than running their own kernel, so kernel-level artifacts (e.g., kernel modules, some syscalls, and host-level kernel logs) are not isolated within the container and must be examined on the host instead. Option B is not correct because containers and their images can be imaged or exported using standard tools such as docker export, docker save, or dd on the underlying storage, so this is not an inherent limitation. Option C is not correct because container logs are not always centralized; by default they are stored locally on the host (e.g., under /var/lib/docker/containers or via the configured logging driver), and centralization only occurs if a logging driver or aggregation system is explicitly configured.

Answer

Containers cannot be imaged using standard forensic tools

Answer

Container logs are always stored in a centralized location

Question 13

A forensic analyst is investigating a Windows system and wants to identify recently executed programs. Which TWO artifacts should the analyst examine?

Accepted Answer

Prefetch files. Prefetch files (B) are correct because Windows stores execution metadata in C:\Windows\Prefetch as .pf files, recording the executable name, run count, and last-run timestamps, making them a primary artifact for proving program execution. UserAssist (C) is correct because it tracks GUI-based program launches via ROT13-encoded entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist, including run counts and last-execution times for user-initiated applications. MRU lists (A) only show recently accessed files or commands, not necessarily executed programs, so they are weaker execution evidence. ShellBags (D) record folder view settings and window positions, reflecting folder navigation rather than program execution. Jump lists (E) are tied to taskbar/application recent-item history and indicate files opened by an application, but they do not directly prove that a program itself was executed.

Answer

MRU lists

Answer

ShellBags

Answer

Jump lists

Question 14

Which TWO of the following are common challenges specific to cloud forensics? (Select TWO)

Accepted Answer

Data jurisdiction and legal compliance. Option C (Data jurisdiction and legal compliance) is correct because cloud data is often stored across multiple geographic regions and controlled by different providers, so forensic investigators must navigate varying laws, privacy regulations (e.g., GDPR), and cross-border data-access rules that complicate evidence collection and chain of custody. Option D (Multi-tenancy and separation of data) is correct because cloud resources are shared among multiple customers on the same physical infrastructure, making it difficult to isolate one tenant's data and artifacts without affecting or exposing others, which is a challenge unique to cloud environments. Options A and B are not specific to cloud forensics: volatile memory acquisition is a general digital-forensics challenge present on any live system, and the inability to image hard drives is generally false since providers and customers can often snapshot or image volumes (though access may be restricted). Option E is also not cloud-specific, as lack of proper tools is a generic limitation across many forensic domains rather than a challenge unique to cloud forensics.

Answer

Volatile memory acquisition

Answer

Inability to image hard drives

Answer

Lack of proper tools

Question 15

During an investigation of a web application breach, an analyst reviews IIS logs and finds numerous entries with status code '200' and URIs containing '?cmd=' followed by encoded strings. The analyst also notices that some requests have a 'User-Agent' string resembling 'Microsoft-CryptoAPI/10.0'. What is the MOST likely conclusion?

Accepted Answer

A webshell is being used to execute commands on the server. The presence of numerous HTTP 200 (success) responses with URIs containing '?cmd=' followed by encoded strings indicates that an attacker is sending command execution requests to a webshell on the server. The unusual User-Agent string 'Microsoft-CryptoAPI/10.0' is a known evasion technique used by webshell tools (e.g., China Chopper variants) to blend in with legitimate Windows update traffic. Successful command execution returns a 200 status, confirming the webshell is active and under attacker control.

Answer

The logs indicate a successful SQL injection attack

Answer

The logs show a cross-site scripting (XSS) attack targeting administrators

Answer

The server is infected with ransomware, encrypting files