CHFI Practice Test 34 — 15 Questions

Question 1

A Windows system's registry key 'HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR' contains a subkey with a serial number. What does this artifact indicate?

Accepted Answer

A USB storage device was attached. The registry key 'HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR' specifically enumerates USB mass storage devices (e.g., flash drives, external hard drives). The presence of a subkey with a serial number indicates that a USB storage device was attached and recognized by the Windows operating system, as the serial number uniquely identifies the device. This key is a primary artifact in USB forensics for tracking storage device connections.

Answer

A USB network adapter was attached

Answer

A USB printer was attached

Answer

A USB keyboard was attached

Question 2

An analyst recovers a disk image from a Linux server that used ext4. The image shows a superblock backup at multiple offsets. Which dd command would correctly extract the backup superblock located at offset 32768 bytes?

Accepted Answer

dd if=image.dd of=superblock.bin bs=512 skip=64 count=2. Both options B and C correctly extract the backup superblock from the disk image. The ext4 superblock is 1024 bytes and starts at offset 32768 bytes. With bs=512, skip=64 gives offset 32768 (64*512=32768), and count=2 reads 1024 bytes (2*512=1024). With bs=1024, skip=32 gives offset 32768 (32*1024=32768), and count=1 reads 1024 bytes. Both commands extract exactly the superblock. Option A uses bs=4096 and count=1, reading 4096 bytes, which is too much and may include adjacent data. Option D uses bs=32768 and count=1, reading 32768 bytes, far exceeding the superblock size.

Answer

dd if=image.dd of=superblock.bin bs=4096 skip=8 count=1

Answer

dd if=image.dd of=superblock.bin bs=32768 skip=1 count=1

Question 3

During a forensic examination of an NTFS drive, an investigator finds that a file 'notes.txt' has an additional data stream named 'hidden.txt' attached. Which feature of NTFS allows this?

Accepted Answer

Alternate Data Streams (ADS). C is correct because NTFS supports Alternate Data Streams (ADS), a feature that allows multiple data streams to be associated with a single file. The 'hidden.txt' stream attached to 'notes.txt' is a classic example of ADS, which can be used to hide data or store metadata without affecting the file's primary content.

Answer

USN Journal

Answer

MFT

Answer

Slack space

Question 4

During a malware analysis session, an analyst uses Process Monitor (Procmon) to observe a suspicious executable. Which of the following behavioral indicators would MOST strongly suggest the malware is attempting to establish persistence?

Accepted Answer

Writing to HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Writing to HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism because Windows automatically launches programs listed in this registry key at user logon. Process Monitor capturing a write to this key directly indicates the malware is configuring itself to run on startup, which is the strongest evidence of persistence among the options.

Answer

Making outbound TCP connections to an IP address

Answer

Creating a named mutex

Answer

Creating files in the %TEMP% directory

Question 5

A security team suspects a data breach via an external attacker. The incident response plan requires preservation of evidence for legal proceedings. Which order of volatility should the first responder follow?

Accepted Answer

Capture memory, record network connections, acquire disk image, then collect backups.. The order of volatility (OOV) dictates that the most volatile data (memory/registers) must be captured first, followed by network connections, then disk images, and finally backups. This sequence minimizes data loss and ensures evidence integrity for legal proceedings, as volatile data is lost when power is removed.

Answer

Capture disk image, then memory, then network connections.

Answer

Record network connections, capture disk image, then memory.

Answer

Collect backups first, then disk image, then memory.

Question 6

In malware static analysis, a PE file is examined. The section names include '.text', '.rdata', '.data', and '.rsrc'. The entry point is in the .text section. Which tool would be MOST appropriate to identify any packer that might be obfuscating the code?

Accepted Answer

PEiD. PEiD is specifically designed to detect packers, cryptors, and compilers by scanning PE files for known signatures in the entry point and section headers. Since the question asks for identifying a packer that obfuscates code, PEiD's signature-based detection directly targets this need, unlike general-purpose disassemblers or string extractors.

Answer

strings

Answer

Ghidra

Answer

IDA Pro

Question 7

An analyst is examining an NTFS volume and finds that a file's $MFT record indicates it is resident. What does this imply about the file's data?

Accepted Answer

The file's data is stored within the $MFT record itself, suitable for small files. When a file's $MFT record indicates it is resident, the file's data is stored entirely within the $MFT record itself. This occurs for small files (typically under 512–1024 bytes) to optimize storage and access speed, as the data does not need to be placed in separate clusters on the NTFS volume.

Answer

The file is compressed and stored across multiple clusters

Answer

The file uses alternate data streams to hide data

Answer

The file is a directory junction point

Question 8

An analyst examining Apache access logs finds the following entry: 192.168.1.10 - - [10/Oct/2023:13:55:36 -0400] "GET /search.php?q=1'%20OR%20'1'='1 HTTP/1.1" 200 5324 "-" "Mozilla/5.0". Which of the following attacks is MOST likely occurring?

Accepted Answer

SQL injection. The log entry shows a GET request to /search.php with a query parameter q containing the SQL injection payload 1' OR '1'='1. This classic tautology-based SQL injection attempts to manipulate the SQL query to always return true, potentially bypassing authentication or extracting data. The 200 OK response and 5324 bytes indicate the server processed the malicious input, confirming the attack is SQL injection.

Answer

Cross-site scripting (XSS)

Answer

Remote file inclusion

Answer

Path traversal

Question 9

Which of the following is the BEST description of Locard's exchange principle as applied to digital forensics?

Accepted Answer

Every contact leaves a trace; the perpetrator will leave digital traces on the crime scene. Locard's exchange principle states that every contact leaves a trace. In digital forensics, this means that when a perpetrator interacts with a system—whether by accessing files, running commands, or connecting to a network—they inevitably leave digital artifacts such as log entries, registry keys, metadata, or network connection records. Option C correctly captures this core concept of trace transfer in the digital domain.

Answer

Only original evidence is admissible in court

Answer

Digital evidence must be collected in a manner that preserves its integrity

Answer

Evidence must be documented with a chain of custody

Question 10

Which Windows Registry hive is primarily used to store user-specific application settings and recently accessed files?

Accepted Answer

NTUSER.DAT. NTUSER.DAT is the correct answer because it is the registry hive file that stores per-user settings, including application configurations and recently accessed files (e.g., MRU lists). When a user logs on, Windows loads NTUSER.DAT into HKEY_CURRENT_USER (HKCU), making it the primary repository for user-specific data.

Answer

HKU\.DEFAULT

Answer

HKLM\SYSTEM

Answer

HKLM\SAM

Question 11

A forensic analyst is preparing to testify as an expert witness in court. Which of the following characteristics is MOST essential for the court to accept the analyst's testimony?

Accepted Answer

The analyst's methods are generally accepted in the forensic community. The court's acceptance of expert testimony hinges on the reliability and validity of the methods used, not the analyst's personal involvement or credentials. Under the Daubert standard (or Frye standard in some jurisdictions), the key factor is whether the forensic methods have been subjected to peer review, are generally accepted within the relevant scientific community, and have a known error rate. This ensures the testimony is based on sound scientific principles, not just the analyst's qualifications or role in the case.

Answer

The analyst has direct knowledge of the case

Answer

The analyst has a certification in computer forensics

Answer

The analyst is employed by the prosecution

Question 12

In a Windows forensic investigation, which registry key is used to examine programs that automatically start at system boot for all users?

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run registry key stores programs that automatically start at system boot for all users. This is a system-wide location, meaning any executable listed here runs regardless of which user logs in, making it critical for forensic analysis of persistent malware or unauthorized startup applications.

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Answer

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run

Question 13

Which THREE of the following are common challenges specific to cloud forensics? (Select THREE)

Accepted Answer

Data jurisdiction and legal compliance across regions. Option A is correct because cloud data is stored in provider regions worldwide, so investigators must navigate differing data-protection laws (e.g., GDPR), cross-border legal processes, and jurisdictional conflicts over where evidence resides and who controls it. Option B is correct because auto-scaling, serverless functions, and ephemeral instances can be terminated or recycled at any time, destroying volatile evidence such as RAM contents, running processes, and temporary logs before acquisition can occur. Option C is correct because in cloud environments the customer has no physical access to the underlying hardware; forensic acquisition must rely on provider-mediated methods like VM snapshots, EBS volume copies, or APIs rather than seizing physical hard drives. Option D is not a cloud-specific challenge, since inconsistent log formats are a general logging issue across on-premises and cloud systems rather than unique to cloud forensics. Option E is not a cloud-specific challenge either, as the cost of forensic tools applies broadly to all digital investigations and is not an inherent characteristic of cloud computing.

Answer

Lack of standardized log formats

Answer

High cost of forensic tools

Question 14

A security analyst notices a process named 'svchost.exe' running from the directory 'C:\Users\Public\svchost.exe'. This is suspicious because legitimate svchost.exe runs from 'C:\Windows\System32'. What type of indicator is this?

Accepted Answer

Behavioural indicator. B is correct because the presence of svchost.exe in C:\Users\Public\ instead of C:\Windows\System32 indicates a deviation from the expected execution path, which is a classic behavioral indicator. Behavioral indicators focus on anomalous actions or file placements rather than static attributes like hashes or network traffic.

Answer

Network indicator

Answer

File hash indicator

Answer

Registry key indicator

Question 15

An organization receives a litigation hold notice regarding an ongoing lawsuit. The IT administrator is instructed to preserve all relevant electronic records. Which of the following actions is MOST consistent with proper legal hold implementation?

Accepted Answer

Place a hold on all data that may be relevant by suspending routine deletion and notifying custodians.. A litigation hold (also known as a legal hold) requires suspending routine data deletion and preservation of potentially relevant electronically stored information (ESI). The IT administrator must notify custodians and implement a hold that prevents automated purging (e.g., via retention policies in Exchange or file servers) to comply with the duty to preserve evidence under FRCP Rule 37(e).

Answer

Reboot all servers to ensure they are running the latest patches.

Answer

Immediately delete all emails older than 90 days to reduce data volume.

Answer

Encrypt all data and change access passwords to prevent unauthorized access.