CHFI Practice Test 4 — 10 Questions

Question 1

A security analyst runs a dynamic analysis of a suspected malware sample using Cuckoo Sandbox. The report shows that the sample created a mutex named 'Global\MyMaliciousMutex', added a registry run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, and attempted to communicate with an IP address 185.10.68.12 on port 443. Which of the following is the BEST immediate indicator of compromise (IoC) to share with the threat intelligence team?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IP address 185.10.68.12. The IP address 185.10.68.12 on port 443 is the best immediate indicator of compromise (IoC) because it is a network-based artifact that can be directly blocked at the firewall or monitored for outbound connections. Network-based IoCs are often prioritized in threat intelligence sharing because they enable proactive perimeter defense and are actionable across multiple systems, unlike host-based artifacts (mutexes, registry keys) that require endpoint-level detection. Additionally, the IP address is independent of file hashes and can be used to detect or block communications even when the malware binary changes.

Answer

The registry run key location

Answer

The sample's MD5 hash

Answer

The mutex name 'Global\MyMaliciousMutex'

Question 2

Which of the following principles states that when two objects come into contact, there is a transfer of material between them?

Accepted Answer

Locard's exchange principle. Locard's exchange principle is a foundational concept in forensic science stating that whenever two objects come into contact, there is a transfer of material between them. In digital forensics, this principle applies to the transfer of digital artifacts (e.g., file fragments, metadata, network traces) when systems interact, such as when a suspect's device connects to a server or when data is copied between storage media.

Answer

The best evidence rule

Answer

The chain of custody

Answer

The hearsay rule

Question 3

A forensic analyst is creating a forensic image of a suspect's hard drive using a write blocker. Which of the following BEST describes the purpose of using a hardware write blocker?

Accepted Answer

To ensure that no data is written to the source drive during imaging. A hardware write blocker is a device placed between the suspect drive and the forensic workstation that intercepts and blocks any write commands from the operating system or imaging software. Its primary purpose is to guarantee that the source drive remains completely unaltered during acquisition, preserving the integrity of the evidence for legal and forensic purposes. This is achieved by allowing only read commands to pass through, while all write commands are physically or logically blocked at the hardware level.

Answer

To increase the speed of data acquisition

Answer

To encrypt the forensic image for secure storage

Answer

To allow the suspect drive to be booted without altering data

Question 4

According to Locard's exchange principle, which of the following is MOST relevant to digital forensics?

Accepted Answer

When a person interacts with a digital device, they leave digital traces that can be recovered. Locard's exchange principle states that every contact leaves a trace. In digital forensics, this translates to the fact that when a person interacts with a digital device (e.g., opening a file, browsing a website, or typing a command), they leave digital traces such as log entries, metadata, temporary files, or registry artifacts. These traces can be recovered and analyzed to reconstruct user activity, making option B the most relevant application of the principle in this context.

Answer

The chain of custody must be maintained for all evidence

Answer

Every crime scene contains at least one latent fingerprint

Answer

Digital evidence is always stored in non-volatile memory

Question 5

Which file system artifact in NTFS records file system events such as file creation, deletion, and modification, and is often used to track attacker activities?

Accepted Answer

USN Journal. The USN (Update Sequence Number) Journal is a native NTFS feature that logs all changes to files and directories on a volume, including creation, deletion, and modification events. Forensic analysts use it to reconstruct timelines of attacker activity because it records the reason for the change (e.g., USN_REASON_FILE_CREATE, USN_REASON_FILE_DELETE) along with timestamps and file references, even if the file is later deleted or renamed.

Answer

Event Logs

Answer

Prefetch files

Answer

Registry

Question 6

A forensic investigator uses the 'dd' command to create a forensic image. The original drive has a SHA-256 hash of a1b2c3... and the image produces the same hash. Which rule of evidence does this satisfy?

Accepted Answer

Authenticity. The SHA-256 hash of the original drive matches the hash of the forensic image, proving that the image is an exact, unaltered copy of the original. This satisfies the rule of authenticity, which requires that evidence be shown to be the same as what was originally seized and not tampered with. The hash acts as a digital fingerprint, and matching hashes confirm the integrity and origin of the evidence.

Answer

Reliability

Answer

Completeness

Answer

Admissibility

Question 7

A first responder arrives at a scene where a computer is suspected to contain evidence of fraud. The computer is turned on and a file is open. Which of the following actions should the responder AVOID?

Accepted Answer

Double-clicking the open file to fully view its contents.. Double-clicking the open file alters its last accessed timestamp and may modify file metadata (e.g., NTFS $STANDARD_INFORMATION or $FILE_NAME attributes), potentially destroying volatile evidence. It also risks executing malicious code or changing the file's content if the application auto-saves. The first responder must preserve the current state and capture a forensic image before any interaction with active data.

Answer

Photographing the screen and documenting open windows.

Answer

Noting the time and date from the system clock.

Answer

Using a hardware write blocker to image the hard drive after shutdown.

Question 8

A forensic investigator examines a hard drive and needs to recover deleted files. Which tool is specifically designed for file carving by scanning raw data for file headers and footers without relying on the file system?

Accepted Answer

Foremost. Foremost is a file carving tool that scans raw disk data for known file headers and footers (e.g., JPEG, PDF, ZIP) to recover files independently of the file system metadata. This makes it ideal when the file system is damaged or deleted, as it relies solely on content signatures rather than directory structures.

Answer

Volatility

Answer

Autopsy

Answer

FTK Imager

Question 9

An analyst finds evidence that an attacker used steganography to hide data within image files on the suspect's computer. Which of the following tools is MOST appropriate for detecting steganography in these images?

Accepted Answer

Stegdetect. Stegdetect is specifically designed to detect steganographic content in images by analyzing statistical anomalies in pixel data, such as those introduced by LSB (Least Significant Bit) embedding. It can identify common steganography tools like JSteg, JPHide, and OutGuess, making it the most appropriate choice for this scenario.

Answer

Foremost

Answer

Autopsy

Answer

Volatility

Question 10

During a forensic examination of a Windows system, an analyst runs the Volatility plugin `netscan` on a memory dump. What information does this plugin primarily provide?

Accepted Answer

Network connections and listening sockets with associated processes. The Volatility plugin `netscan` is specifically designed to extract network connection information from Windows memory dumps, including active TCP and UDP connections, listening sockets, and the associated processes that own them. It works by scanning kernel data structures such as `_TCPT_OBJECT` and `_UDP_OBJECT` to provide a snapshot of network activity at the time of capture, which is critical for identifying malicious connections or unauthorized services.

Answer

Open files and handles for each process

Answer

List of all running processes and their parent processes

Answer

The contents of the Windows firewall rules