CHFI Practice Test 36 — 15 Questions

Question 1

During a mobile forensic investigation, an analyst uses Cellebrite UFED to extract data from a locked iOS device. The extraction successfully retrieves the device's passcode, call logs, SMS messages, and application data. Which extraction method did the analyst MOST likely use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Advanced logical extraction. C is correct because Advanced Logical Extraction (ALE) on Cellebrite UFED leverages a combination of file system parsing, agent-based extraction, and exploit techniques to retrieve the device passcode, call logs, SMS messages, and application data from a locked iOS device without requiring a full physical dump. This method bypasses the logical extraction limitations by using a custom agent or AFC (Apple File Conduit) to access protected data, making it the most likely method for the described successful extraction.

Answer

File system extraction

Answer

Physical extraction

Answer

Logical extraction

Question 2

A security analyst discovers a suspicious registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate. The key points to a file in AppData. What is the most likely purpose of this registry key?

Accepted Answer

It ensures the malware runs every time the user logs in. The registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a standard Windows autostart location. Malware commonly adds an entry here to achieve persistence, ensuring it executes every time the user logs in. The suspicious name 'WindowsUpdate' is a common masquerade tactic to hide malicious intent.

Answer

It logs the user's keystrokes

Answer

It is a legitimate Windows update configuration

Answer

It stores the malware's configuration settings

Question 3

In the context of e-discovery, which THREE of the following are key steps in the Electronic Discovery Reference Model (EDRM)? (Select THREE)

Accepted Answer

Preservation. Preservation (A) is a core EDRM step that focuses on safeguarding potentially relevant electronically stored information (ESI) once a duty to preserve is triggered, preventing spoliation before collection occurs. Production (B) is the EDRM phase in which responsive, non-privileged ESI is delivered to the requesting party in an agreed-upon format, often with load files and metadata, completing the exchange. Collection (C) is the EDRM step that gathers the identified and preserved ESI using forensically sound methods so that its integrity and chain of custody are maintained for later processing and review. The other options do not belong: Prosecution (D) is a legal litigation activity, not an EDRM phase, and Investigation (E) is a general fact-finding process that is not one of the nine EDRM stages (Identification, Preservation, Collection, Processing, Review, Analysis, Production, Presentation, and Information Governance).

Answer

Prosecution

Answer

Investigation

Question 4

During an iOS forensic examination, an analyst extracts the SMS.db file from an iTunes backup. Which table within this database contains the actual message content and associated metadata such as timestamps and sender/recipient information?

Accepted Answer

message. The `message` table in SMS.db stores the actual message content (the `text` field) along with critical metadata such as `date` (Unix timestamp), `is_from_me` (sender/recipient indicator), and `handle_id` (foreign key to the `handle` table). This is the primary table for message body and timestamp data in iOS SMS/MMS forensics.

Answer

chat

Answer

attachment

Answer

handle

Question 5

In malware forensics, which of the following is an indicator of compromise (IoC) that can be used to detect a specific malware strain across multiple systems?

Accepted Answer

The file's MD5 hash computed from its binary contents. The MD5 hash of a file's binary contents is a unique cryptographic fingerprint that remains consistent across all copies of the exact same malware strain, regardless of where it is stored or what metadata the filesystem assigns. This makes it a reliable indicator of compromise (IoC) for identifying a specific malware sample across multiple systems, as the hash will match even if file names, sizes, or timestamps differ.

Answer

The file's size in bytes reported by the filesystem

Answer

The file's copyright metadata embedded in the PE header

Answer

The file's creation timestamp as recorded by the operating system

Question 6

An email forensic analyst receives a suspicious email and wants to verify the originating IP address. The analyst extracts the email headers and sees multiple 'Received' fields. Which 'Received' header should the analyst consider as the most trustworthy source of the sender's IP?

Accepted Answer

The last 'Received' header at the bottom. The last 'Received' header at the bottom is the most trustworthy because email headers are added in reverse chronological order: each mail server prepends its own 'Received' field to the top of the header block. Therefore, the bottommost 'Received' header represents the first hop from the sender's MTA (Mail Transfer Agent) or the originating client, making it the closest to the true source IP.

Answer

The first 'Received' header at the top

Answer

The 'X-Originating-IP' header

Answer

The 'Return-Path' header

Question 7

A forensic investigator is analyzing a malware sample that appears to be packed. Using PEiD, the analyst detects an entropy value of 7.8 and the entry point section is named 'UPX0'. Which of the following tools should the analyst use NEXT to unpack the malware for static analysis?

Accepted Answer

UPX -d. The presence of 'UPX0' as the entry point section name and an entropy value of 7.8 (very high, indicating compression or encryption) strongly suggests the malware is packed with UPX (Ultimate Packer for eXecutables). The correct next step is to use UPX with the -d (decompress) switch to unpack the binary, restoring the original executable for static analysis. This is a standard, reversible unpacking method that does not require dynamic analysis or disassembly of the packed stub.

Answer

Ghidra

Answer

Process Monitor

Answer

IDA Pro

Question 8

In the context of the US Fourth Amendment, what is typically required for law enforcement to seize a computer for forensic examination?

Accepted Answer

Consent of the owner, a warrant, or exigent circumstances. The Fourth Amendment requires law enforcement to obtain a warrant based on probable cause, obtain the owner's consent, or demonstrate exigent circumstances before seizing a computer for forensic examination. This protects against unreasonable searches and seizures, and a computer's storage capacity means it can contain vast amounts of personal data, so the same constitutional protections apply as to a physical home or vehicle.

Answer

A subpoena duces tecum

Answer

No legal authorization is needed if the computer is in plain view

Answer

Only a warrant issued by a judge

Question 9

A first responder arrives at a crime scene where a computer is powered on and displaying a desktop. According to best practices, which of the following actions should the responder take FIRST?

Accepted Answer

Photograph the scene and the computer screen.. The first priority at a live crime scene is to document the state of the system before any interaction. Photographing the screen captures volatile data (e.g., open windows, running processes, time) that would be lost upon any keystroke or power change. This aligns with the order of volatility (RFC 3227) and ensures a legally defensible chain of custody from the outset.

Answer

Press Ctrl+Alt+Del to check for active user sessions.

Answer

Connect a write blocker and begin imaging the hard drive.

Answer

Unplug the power cord immediately to preserve volatile data.

Question 10

In a memory forensics investigation using Volatility, an analyst wants to see a list of processes that were active at the time of acquisition, including hidden processes. Which Volatility command should be used?

Accepted Answer

psscan. Psscan, because it scans the physical memory for _EPROCESS structures, allowing it to detect processes that are hidden from the standard linked list used by pslist. This makes psscan the appropriate command for identifying hidden or unlinked processes that were active at the time of acquisition.

Answer

pslist

Answer

pstree

Answer

netscan

Question 11

A malware analyst uses Cuckoo Sandbox to analyze a sample. The report shows that the sample sends HTTP POST requests to 'http://malicious.example.com/gate.php' with encrypted data. Which type of indicator of compromise (IoC) is this?

Accepted Answer

Network-based IoC. The HTTP POST request to a remote URL with encrypted data is a classic network-based indicator because it involves communication over a network protocol (HTTP) to an external server. Cuckoo Sandbox captures this as a network artifact, making it a network-based IoC (Option D). Host-based IoCs focus on file system or registry changes, memory-based on in-RAM artifacts, and hash-based on file fingerprints.

Answer

Host-based IoC

Answer

Memory-based IoC

Answer

Hash-based IoC

Question 12

Which of the following tools is BEST suited for performing static analysis of a malware binary to identify strings, headers, and imported functions without executing the file?

Accepted Answer

IDA Pro. IDA Pro is the correct choice because it is a disassembler and debugger specifically designed for static analysis of binary executables. It allows an analyst to examine strings, PE/ELF headers, and imported functions without executing the file, making it ideal for malware reverse engineering. In contrast, the other options require execution or focus on runtime behavior.

Answer

Cuckoo Sandbox

Answer

Any.run

Answer

Process Monitor

Question 13

Which mobile forensics tool is specifically designed for physical extraction of iOS devices, including bypassing passcodes and extracting full file system images?

Accepted Answer

GrayKey. GrayKey is a specialized forensic tool developed by GrayShift that performs physical extraction on iOS devices, including bypassing passcodes and obtaining full file system images. It exploits hardware and software vulnerabilities in iOS to extract data, making it the correct choice for this specific task.

Answer

Oxygen Forensic Detective

Answer

Magnet AXIOM

Answer

Cellebrite UFED

Question 14

An analyst is performing malware analysis and executes a suspicious binary in a sandbox. The sandbox reports that the binary creates a mutex named 'Global\DRIVER_UPDATE_MTX' before attempting to connect to 'http://malicious.com/update'. Which tool would BEST capture the network traffic during dynamic analysis?

Accepted Answer

Wireshark. Wireshark is the correct tool because it captures and analyzes network packets at the protocol level, allowing the analyst to inspect the HTTP request to 'http://malicious.com/update', including headers, payload, and any subsequent data exfiltration. Dynamic analysis of malware requires monitoring network traffic to identify command-and-control (C2) communications, and Wireshark provides full packet capture (PCAP) for this purpose.

Answer

Regshot

Answer

Process Explorer

Answer

Process Monitor

Question 15

During an Android forensic examination, the analyst uses ADB to run 'adb shell dumpsys batterystats --reset' before acquiring data. What is the MOST likely purpose of this command?

Accepted Answer

This command is not recommended in forensic acquisition as it may destroy potential evidence. The 'adb shell dumpsys batterystats --reset' command clears the battery statistics logs on the device. In forensic acquisition, any command that modifies or deletes data on the device is considered destructive to evidence. The reset operation removes historical battery data that may contain timestamps and app usage patterns, which could be critical evidence. Therefore, this command is not recommended in forensic acquisition as it may destroy potential evidence.

Answer

To clear battery logs that may contain evidence of app activity

Answer

To ensure the device is in a low-power state for safe extraction

Answer

To optimize device performance during imaging