CHFI Practice Test 33 — 15 Questions

Question 1

A forensic examiner needs to acquire a hard drive that is part of a RAID 5 array. The RAID controller is unavailable. What is the best approach to acquire the data?

Accepted Answer

Acquire each disk individually, then reconstruct the array using software. When the RAID controller is unavailable, the only reliable method to acquire the data is to image each physical disk individually using a forensic write blocker, then reconstruct the logical RAID 5 volume in a forensic software tool (e.g., FTK Imager, X-Ways Forensics, or EnCase). This preserves the original evidence on each disk and allows the examiner to rebuild the array by specifying the stripe size, parity rotation, and disk order, which is essential because RAID 5 distributes data and parity across all disks and can tolerate a single disk failure.

Answer

Acquire only one disk because RAID 5 can be reconstructed from a single disk

Answer

Use a hardware write blocker that supports RAID

Answer

Connect the RAID array to a similar controller and acquire as a single drive

Question 2

An analyst discovers a suspicious file named 'cmd.aspx' in the web root of an IIS server. The file contains ASPX code that executes system commands. The IIS logs show a POST request to '/cmd.aspx' with a 200 status code. Which type of attack is indicated?

Accepted Answer

Webshell upload. The presence of a file named 'cmd.aspx' in the IIS web root that executes system commands, combined with a POST request returning a 200 status code, indicates a webshell upload attack. An attacker has uploaded an ASPX file that acts as a backdoor, allowing remote command execution via HTTP POST requests, which is a classic webshell scenario.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Question 3

In network forensics, which tool is specifically designed for packet capture and analysis, allowing examiners to inspect individual packets and reconstruct network conversations?

Accepted Answer

Wireshark. Wireshark is the correct answer because it is a full-featured packet analyzer that captures live network traffic and provides deep inspection of hundreds of protocols. It allows examiners to filter packets, follow TCP streams, and reconstruct entire network conversations, making it the standard tool for network forensics analysis.

Answer

Tcpdump

Answer

Netstat

Answer

Nmap

Question 4

During a forensic investigation, you find a prefetch file created at 03:15:22 UTC on the system. The corresponding executable's last modified timestamp is 02:30:00 UTC, and the system date/time shows a discrepancy of +5 minutes. What is the MOST accurate interpretation regarding the file execution time?

Accepted Answer

The program was executed at 03:10:22 UTC after adjusting for clock skew.. The prefetch file creation timestamp records the system time at execution. The system clock is +5 minutes ahead, so actual UTC at execution is 03:10:22 (03:15:22 minus 5 minutes). Option D correctly adjusts for this clock skew. Option B is wrong because it ignores the clock discrepancy, which is a known issue in forensic analysis.

Answer

The program was executed at 02:30:00 UTC.

Answer

The program was executed at 03:15:22 UTC.

Answer

Execution time cannot be determined from prefetch files alone.

Question 5

During a cloud forensic investigation, the analyst discovers that the suspect used AWS IAM credentials to launch unauthorized EC2 instances. The suspect claims the credentials were stolen. Which log would the analyst examine to determine the source IP address from which the credentials were used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made to the AWS environment, including the `RunInstances` action that launches EC2 instances. Each CloudTrail event contains the `sourceIPAddress` field, which captures the IP address from which the IAM credentials were used. This makes CloudTrail the definitive log to identify the origin of the unauthorized activity.

Answer

VPC Flow Logs

Answer

Amazon Inspector findings

Answer

AWS Config

Question 6

Which of the following is the primary purpose of using a hardware write blocker during disk acquisition?

Accepted Answer

To prevent any writes to the original evidence drive. A hardware write blocker is a device placed between the suspect drive and the forensic workstation that intercepts and blocks any write commands from the host operating system, ensuring that the original evidence drive remains unaltered. This is critical for maintaining the integrity of digital evidence, as any modification to the source drive could render it inadmissible in court. The primary purpose is therefore to prevent any writes to the original evidence drive, preserving its exact state for forensic analysis.

Answer

To decrypt the drive during acquisition

Answer

To compress the acquired image

Answer

To increase the speed of the acquisition

Question 7

An analyst is examining a RAID 5 array of three disks. One disk has failed and been replaced; the array is rebuilding. Which of the following is the most significant forensic challenge regarding data acquisition from this array?

Accepted Answer

The rebuild process may overwrite unallocated space or remnants of deleted files. During a RAID 5 rebuild, the array controller reads parity and data from the remaining healthy disks to reconstruct the missing data onto the replacement disk. This process writes to the entire replacement disk, including areas that previously held unallocated space or remnants of deleted files, potentially overwriting critical forensic evidence. The rebuild is a low-level write operation that does not respect file system boundaries, making it a significant challenge for data acquisition.

Answer

The failed disk cannot be imaged because it is physically damaged

Answer

RAID 5 arrays cannot be imaged using traditional tools like dd

Answer

The array must be imaged while degraded to preserve evidence

Question 8

Which TWO of the following are valid justifications for a first responder to power off a computer at a crime scene? (Select TWO)

Accepted Answer

The computer is destroying evidence (e.g., running a data wiping program). Option C is correct because if a system is actively destroying evidence—such as running a data-wiping utility, secure-delete command, or encryption routine—the first responder must cut power immediately to preserve volatile and non-volatile data before it is irrecoverably lost. Option D is correct because a hazardous environment like flooding, fire, or electrical danger poses a risk to life and safety, and preserving human safety takes precedence over evidence collection, justifying powering off (or otherwise safely disconnecting) the machine. Option A is not a valid justification because modern computers have thermal protections and overheating is not a recognized forensic reason to power down, which would actually destroy volatile evidence. Option B is not valid because saving time is never an acceptable justification for altering a crime scene, as proper forensic procedure prioritizes evidence integrity over speed. Option E is not valid because a computer actively being used to commit a crime should typically be left running to capture live evidence (e.g., RAM, network connections, running processes), not powered off.

Answer

To prevent the computer from overheating

Answer

To save time during the investigation

Answer

The computer is actively being used to commit a crime

Question 9

Which of the following BEST describes Locard's exchange principle as applied to digital forensics?

Accepted Answer

Every contact leaves a trace; an attacker will leave digital evidence on the compromised system.. Locard's exchange principle states that every contact leaves a trace. In digital forensics, this means that when an attacker interacts with a compromised system, they inevitably leave behind digital artifacts such as log entries, modified files, registry changes, or network connection records. Option D correctly captures this core concept as applied to digital forensics.

Answer

Digital evidence must be collected using a write blocker.

Answer

The chain of custody must be documented for evidence to be admissible.

Answer

Volatile data must be collected before powering off a system.

Question 10

A forensics examiner finds a suspicious entry in the Windows Registry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to a PowerShell command. Which persistence mechanism does this represent, and what is the MOST likely impact?

Accepted Answer

Registry run key persistence; the command executes each time the user logs in.. The HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard Windows Run key that automatically executes programs when the user logs in. A PowerShell command placed here will run with the user's privileges at each interactive logon, establishing persistence without requiring elevated privileges or system-level access.

Answer

Service persistence; the malware runs as a system service.

Answer

Scheduled task persistence; the command runs at a scheduled time.

Answer

Bootkit persistence; the malware loads before the OS.

Question 11

During a forensic acquisition, you notice that the target drive has bad sectors. What is the best approach to acquire the drive?

Accepted Answer

Use ddrescue to recover as much data as possible. B is correct because ddrescue is specifically designed to handle media with bad sectors by using a sophisticated read-retry algorithm that logs errors and attempts recovery from multiple angles, including reverse reads and splitting the drive into good and bad regions. Unlike dd, which will abort or produce corrupted output on encountering a bad sector, ddrescue maximizes data recovery while preserving a map of unrecoverable areas.

Answer

Use dd with a higher block size to skip bad sectors

Answer

Use FTK Imager and ignore the errors

Answer

Perform a physical acquisition by removing platters

Question 12

During a malware analysis, an analyst uses a tool to monitor registry changes, file system modifications, and process activity simultaneously. Which tool is BEST suited for this integrated monitoring?

Accepted Answer

Process Monitor. Process Monitor (ProcMon) is the correct tool because it integrates real-time monitoring of registry changes, file system modifications, and process/thread activity into a single interface. It combines the legacy tools Regmon (registry) and Filemon (file system) with process monitoring, allowing an analyst to correlate events across all three subsystems simultaneously, which is essential for dynamic malware analysis.

Answer

Wireshark

Answer

Regshot

Answer

Process Explorer

Question 13

A forensic analyst is examining a Windows system for evidence of a program that runs automatically every time the system starts. Which registry key is commonly used to achieve persistence via the 'Run' key?

Accepted Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Run. The 'Run' key at HKLM\Software\Microsoft\Windows\CurrentVersion\Run is the standard registry location used by legitimate software and malware alike to execute a program automatically at every system startup. This key stores values that point to executable paths, and Windows’ Winlogon process reads these values during boot to launch the specified programs. It is a primary persistence mechanism in Windows forensics.

Answer

HKLM\SAM\SAM

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Question 14

Which file system uses a Master File Table ($MFT) as its central catalog for file metadata?

Accepted Answer

NTFS. NTFS (New Technology File System) uses the Master File Table ($MFT) as its central catalog to store metadata about every file and directory on the volume. Each file or directory has at least one record in the $MFT, which contains attributes such as timestamps, security descriptors, data runs, and the file's name. This design is fundamental to NTFS's ability to support advanced features like journaling, hard links, and alternate data streams.

Answer

FAT32

Answer

APFS

Answer

ext4

Question 15

Which email header field is specifically used to verify that an email was not tampered with during transit and is signed by the sender's domain?

Accepted Answer

DKIM-Signature. The DKIM-Signature header field is the correct answer because it provides a cryptographic signature that allows the receiver to verify that the email was not altered in transit and that it originated from the claimed domain. DKIM (DomainKeys Identified Mail) uses public-key cryptography, where the sender's domain publishes a public key in DNS, and the sending server signs the email with the corresponding private key. This ensures both integrity and domain-level authentication, directly matching the question's requirement.

Answer

X-Originating-IP

Answer

Message-ID

Answer

Received