CHFI Practice Test 36 — 15 Questions

Question 1

During a network forensic investigation, the analyst examines firewall logs and notices a large number of outbound connections from an internal server to various IP addresses on port 443 at regular intervals. The connections are all initiated by a process called 'svchost.exe' running from a non-standard location (C:\Windows\Temp). What is the MOST likely explanation?

Accepted Answer

The server is infected with malware that is beaconing to a command-and-control server. svchost.exe from C:\Windows\Temp indicates a masquerading technique where malware names itself after a legitimate Windows process but runs from an unauthorized location. The outbound connections on port 443 are likely command-and-control (C2) traffic.

Answer

The server is running a scheduled backup to an external cloud service

Answer

The server is performing legitimate Windows Update checks

Answer

The server is being used as a proxy for internal users

Question 2

A SOC analyst is analyzing a packet capture from a network where an internal host communicated with a known malicious IP. The analyst uses Wireshark and applies a display filter to isolate all HTTP traffic. Which filter expression should he use?

Accepted Answer

http. The correct filter for HTTP traffic in Wireshark is 'http'. Wireshark uses protocol names in lowercase for display filters.

Answer

http.request

Answer

ip.proto == 6

Answer

tcp.port == 80

Question 3

In Linux forensics, which file contains information about user account passwords in hashed form?

Accepted Answer

/etc/shadow. The /etc/shadow file stores password hashes (in modern Linux systems). It is readable only by root.

Answer

/etc/passwd

Answer

/etc/group

Answer

/var/log/auth.log

Question 4

A forensic examiner needs to analyze the contents of a Windows prefetch file (.pf) to determine the last execution time of an application. Which tool would BEST accomplish this task?

Accepted Answer

PECmd. Prefetch files contain metadata including last run time and run count. Tools like PECmd (from Eric Zimmerman's tools) are designed to parse .pf files forensically.

Answer

prefetch.exe (built‑in Windows tool)

Answer

ShellBags Explorer

Answer

JumpLister

Question 5

A forensic analyst is examining a network packet capture for signs of data exfiltration. Which THREE of the following are common indicators of data exfiltration over DNS? (Select three.)

Accepted Answer

DNS responses with unusually large payloads (e.g., TXT records). DNS exfiltration often uses high query volumes, unusual domain names, and large TXT records.

Answer

Low TTL values in DNS responses

Answer

DNS queries sent to multiple different DNS servers

Question 6

During a forensic investigation, you find a prefetch file created at 03:15:22 UTC on the system. The corresponding executable's last modified timestamp is 02:30:00 UTC, and the system date/time shows a discrepancy of +5 minutes. What is the MOST accurate interpretation regarding the file execution time?

Accepted Answer

The program was executed at 03:15:22 UTC.. Prefetch files record the time the program was first run. The last modified timestamp of the executable is not directly related to execution time. The prefetch timestamp is the best indicator of first execution, but time zone and clock skew must be considered. However, the question asks for the MOST accurate interpretation among the options; the prefetch file creation time directly records when the program was first executed, making that the execution time.

Answer

The program was executed at 02:30:00 UTC.

Answer

Execution time cannot be determined from prefetch files alone.

Answer

The program was executed at 03:10:22 UTC after adjusting for clock skew.

Question 7

Which TWO of the following are tools commonly used for network forensics analysis? (Select two.)

Accepted Answer

tcpdump. Wireshark and tcpdump are standard tools for capturing and analyzing network packets. Volatility is for memory forensics, Autopsy is for disk forensics, and dd is for disk imaging.

Answer

Autopsy

Answer

Volatility

Answer

dd

Question 8

A security analyst reviews Windows Security Event Log and notices multiple Event ID 4625 entries for a single user account from various IP addresses within a short time frame. What is the MOST likely attack being attempted?

Accepted Answer

Brute-force password attack. Event ID 4625 indicates a failed logon attempt. Multiple failures from different IPs in a short period is characteristic of a brute-force password guessing attack.

Answer

Kerberos golden ticket attack

Answer

ARP spoofing attack

Answer

Pass-the-hash attack

Question 9

A security analyst reviewing Windows Security Event Logs sees multiple Event ID 4625 entries for a single user account, followed by a successful Event ID 4624. The account is a domain administrator. What is the MOST likely explanation?

Accepted Answer

An attacker performed a brute-force password attack and succeeded. This pattern indicates a successful brute-force attack where the attacker guessed the password and then logged in successfully. Event ID 4625 indicates failed logon attempts, and Event ID 4624 indicates a successful logon.

Answer

The user typed their password incorrectly several times before succeeding

Answer

The system experienced a denial of service attack

Answer

A misconfigured application caused repeated logon attempts

Question 10

Which TWO of the following are common Linux log files that can be used for forensic analysis?

Accepted Answer

/var/log/syslog. /var/log/auth.log records authentication attempts, and /var/log/syslog records general system messages. Both are valuable in forensic investigations.

Answer

/etc/passwd

Answer

/etc/shadow

Answer

/proc/cpuinfo

Question 11

Which THREE of the following are commonly used network forensic data sources?

Accepted Answer

NetFlow logs. Packet captures (PCAP), NetFlow logs, and IDS/IPS logs are all standard network forensic data sources that provide detail on network traffic.

Answer

Prefetch files

Answer

Windows registry hives

Question 12

In a database forensic investigation, you recover a MySQL binary log with the following entry: #230110 13:45:22 server id 1 end_log_pos 123456 Query thread_id=100 exec_time=0 error_code=0 SET TIMESTAMP=1673358322; SELECT * FROM customers INTO OUTFILE '/tmp/export.csv';. What does this indicate?

Accepted Answer

Data exfiltration via the MySQL instance. This log entry records a SELECT ... INTO OUTFILE statement that exports the customers table to a CSV file. This is a common technique for data exfiltration, as it writes data to a file that can be accessed by the attacker.

Answer

A backup operation was performed

Answer

A stored procedure execution

Answer

A SQL injection attack using UNION

Question 13

An email forensic analyst receives a suspicious email and examines the full headers. Which header field is the MOST reliable for determining the true originating IP address of the sender, assuming no spoofing of the header?

Accepted Answer

Received. The Received headers are added by each SMTP server; the first Received header (bottommost) contains the IP of the originating server.

Answer

Return-Path

Answer

Message-ID

Answer

From

Question 14

A forensic analyst is examining Azure Activity Logs for signs of privilege escalation. Which TWO of the following activities would be MOST indicative of an attacker attempting to escalate privileges? (Choose two.)

Accepted Answer

Creation of a custom RBAC role with Owner permissions. Creating a custom RBAC role with high permissions (like Owner) and assigning it to a user can grant elevated privileges. Adding a user to a privileged role (like Global Administrator) directly escalates privileges.

Answer

A user updating their own password

Answer

Deleting a resource group

Answer

A user accessing a storage account they own

Question 15

A network analyst captures traffic and sees an HTTP request containing: GET /wp-content/uploads/evil.php?cmd=id HTTP/1.1. Which of the following is MOST likely occurring?

Accepted Answer

Webshell access. The request attempts to execute a command (id) via a PHP file in the uploads directory, indicating a webshell. Webshells allow attackers to execute commands on the server.

Answer

SQL injection attack

Answer

Cross-site scripting (XSS) attack

Answer

Directory traversal attack