CHFI Practice Test 38 — 15 Questions

Question 1

A network analyst captures suspicious traffic and uses Wireshark to examine packets. The analyst notices many TCP SYN packets sent to various ports on a single host with no SYN-ACK replies. What type of activity is MOST likely observed?

Accepted Answer

Port scan. A port scan sends SYN packets to multiple ports to identify open ones; lack of SYN-ACK replies indicates closed ports.

Answer

Denial of Service (DoS) attack

Answer

DNS amplification

Answer

ARP poisoning

Question 2

A forensic analyst is performing timeline analysis on a compromised system. Which tool is specifically designed to parse multiple log sources and create a super timeline?

Accepted Answer

log2timeline. log2timeline (and Plaso) is a toolset for creating super timelines from various forensic artifacts.

Answer

Sleuth Kit

Answer

Volatility

Answer

Wireshark

Question 3

Which THREE of the following are persistence mechanisms that can be used on Linux systems?

Accepted Answer

Startup scripts in /etc/init.d. Cron jobs, startup scripts in /etc/init.d, and modifications to /etc/passwd to create backdoor accounts are all persistence techniques on Linux. SSH keys are not a persistence mechanism but rather an access method.

Answer

Prefetch files

Answer

SSH authorized keys

Question 4

Which TWO pieces of information can be obtained from an email's Received headers to help trace the email's origin? (Select TWO)

Accepted Answer

The IP address of the originating mail server. Received headers show each mail server the email passed through, including its IP address and timestamp.

Answer

The DKIM signature hash

Answer

The sender's email client version

Answer

The subject line of the email

Question 5

Which Windows artifact is specifically designed to track the most recently used (MRU) files for specific applications and can be found in the NTUSER.DAT registry hive?

Accepted Answer

MRU lists in the registry. MRU lists are stored in the registry under NTUSER.DAT\(various keys such as \Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePIDlMRU). They track recently opened files.

Answer

Prefetch files

Answer

Jump Lists

Answer

LNK files

Question 6

A forensic analyst is examining a Windows system for evidence of a program that runs automatically every time the system starts. Which registry key is commonly used to achieve persistence via the 'Run' key?

Accepted Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Run. The Run key under HKLM\Software\Microsoft\Windows\CurrentVersion\Run is a common location for programs to execute at startup. Similar keys exist in HKCU.

Answer

HKLM\SAM\SAM

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Question 7

During a forensic investigation of a Linux system, you need to determine which commands a user executed in their shell session. Which file would you examine to find this information?

Accepted Answer

/home/username/.bash_history. The bash_history file in the user's home directory (e.g., /home/username/.bash_history) records commands entered by the user in bash. Note that history may not be complete if the user opened multiple sessions or the file was cleared.

Answer

/var/log/auth.log

Answer

/etc/passwd

Answer

/var/log/syslog

Question 8

A forensic investigator is examining a Linux system compromised via a web application. Which THREE artifacts should the investigator prioritize to determine the attacker's entry point and post-exploitation activities?

Accepted Answer

/home/compromised_user/.bash_history. The web server logs (access.log) can show the initial exploit request. auth.log may show authentication events if credentials were used. bash_history can reveal commands executed after compromise. cron jobs are persistence mechanisms but not entry point. /etc/shadow stores password hashes, not attack details.

Answer

/etc/shadow

Answer

Cron job entries in /etc/crontab

Question 9

A Linux system administrator notices unusual outbound connections from a server. Which of the following commands would MOST effectively capture a list of all current network connections along with the associated process IDs?

Accepted Answer

sudo ss -tunap. The 'ss -tunap' command displays TCP/UDP sockets with process information. 'netstat -tunap' is similar but deprecated on many systems. 'lsof -i' shows open files for network connections.

Answer

sudo iptables -L

Answer

sudo lsmod

Answer

sudo ifconfig -a

Question 10

Which Linux log file is the PRIMARY source for authentication-related events such as user logins, sudo usage, and failed authentication attempts?

Accepted Answer

/var/log/auth.log. /var/log/auth.log (or /var/log/secure on RHEL) stores authentication logs. /var/log/syslog contains general system messages. /var/log/kern.log is for kernel messages.

Answer

/var/log/kern.log

Answer

/var/log/syslog

Answer

/var/log/boot.log

Question 11

A forensic analyst needs to create a timeline of file system activity from a disk image. Which tool is specifically designed for this purpose and can parse various artifacts such as registry, prefetch, and log files?

Accepted Answer

Plaso (log2timeline). Plaso (log2timeline) is a super timeline tool that parses multiple artifacts to create a comprehensive timeline. Wireshark is for network packets. FTK Imager is for acquisition. Volatility is for memory analysis.

Answer

Wireshark

Answer

Volatility

Answer

FTK Imager

Question 12

A forensic investigator is examining a Mac system and wants to review recently accessed files and applications. Which macOS artifact is MOST useful for this purpose?

Accepted Answer

FSEvents (/.fseventsd). FSEvents records file system events such as file creation, modification, and deletion. It is a key artifact for timeline analysis on macOS.

Answer

bash_history

Answer

.plist files in ~/Library/Preferences/

Answer

Unified Logging (log stream)

Question 13

A forensic analyst is examining browser history from a Chrome installation on a Windows system. Where is the Chrome history database typically stored?

Accepted Answer

%LOCALAPPDATA%\Google\Chrome\User Data\Default\History. Chrome stores history in an SQLite database file named 'History' located in the user's default profile directory under %LOCALAPPDATA%\Google\Chrome\User Data\Default\.

Answer

%APPDATA%\Mozilla\Firefox\Profiles\

Answer

%WINDIR%\System32\config\

Answer

%USERPROFILE%\Favorites\

Question 14

Which Windows registry hive should be examined to determine the last time a specific external USB drive was connected to a system?

Accepted Answer

HKLM\SYSTEM. The SYSTEM hive (specifically HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR) contains identifiers and timestamps for every USB device that has been attached.

Answer

HKLM\SAM

Answer

HKLM\SOFTWARE

Answer

HKLM\SECURITY

Question 15

During a forensic investigation of a compromised Linux server, an analyst checks /var/log/auth.log and finds multiple entries like "Failed password for root from 10.0.0.5 port 22 ssh2". Which tool is BEST suited to analyze the timeline of these events?

Accepted Answer

log2timeline. log2timeline (part of Plaso) is designed for timeline analysis of log files, including auth.log. It parses and correlates timestamps.

Answer

Nmap

Answer

Wireshark

Answer

Autopsy