CHFI Practice Test 40 — 15 Questions

Question 1

A security analyst observes a suspicious process creating multiple mutexes with names like 'XxX_12345' and 'XxX_67890' and making outbound connections to an IP address 185.130.5.1 on port 443. Which behavioral indicator is MOST consistent with malware communication?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The mutexes indicate an attempt to prevent multiple instances, and outbound connections suggest C2 activity. The creation of mutexes with a consistent naming pattern (e.g., 'XxX_12345') is a classic anti-replication mechanism used by malware to ensure only one instance runs on a system, preventing conflicts and detection. The outbound connections to a specific IP on port 443 (HTTPS) are highly indicative of command-and-control (C2) communication, as malware often uses encrypted channels to blend in with legitimate traffic. Option C correctly identifies both the mutex's purpose (preventing multiple instances) and the network behavior (C2 activity), making it the most consistent with malware communication.

Answer

The process is performing data exfiltration via DNS tunneling

Answer

The process is attempting to spread to other machines via SMB

Answer

The process is a legitimate application using mutexes for inter-process communication

Question 2

Which file system artifact in NTFS is used to hide data by appending a stream to an existing file without affecting its primary data stream?

Accepted Answer

Alternate Data Streams (ADS). Alternate Data Streams (ADS) are a feature of the NTFS file system that allows a file to have multiple data streams associated with it. Data written to an alternate stream does not appear in the primary stream, so the file's size and content as seen by standard tools remain unchanged, making it a common method for hiding data.

Answer

USN Journal

Answer

$Recycle.bin

Answer

Master File Table ($MFT)

Question 3

Which network forensic tool is BEST suited for analyzing NetFlow data to identify top talkers and detect anomalies?

Accepted Answer

SiLK. SiLK (System for Internet-Level Knowledge) is specifically designed for large-scale NetFlow data analysis, providing tools to aggregate flow records, identify top talkers (e.g., using rwtop or rwstats), and detect anomalies through statistical baselines. Unlike packet-level tools, SiLK works directly with flow summaries, making it efficient for high-volume network traffic analysis in forensic investigations.

Answer

tcpdump

Answer

Nmap

Answer

Wireshark

Question 4

A forensic examiner finds a file on an NTFS volume that appears to have data hidden in its alternate data stream. The file's size is reported as 10 KB, but the volume's cluster size is 4 KB. How many clusters of file slack could potentially contain hidden data in the primary stream?

Accepted Answer

2 KB. The file's primary stream occupies 10 KB, which requires 3 clusters (3 × 4 KB = 12 KB). The slack space is the unused portion of the last cluster: 12 KB - 10 KB = 2 KB. This 2 KB of file slack in the primary stream could potentially contain hidden data, making option C correct.

Answer

12 KB

Answer

4 KB

Answer

0 KB

Question 5

During a forensic examination, an analyst uses the command 'dd if=/dev/sda of=/mnt/evidence/image.dd bs=4096 conv=noerror,sync'. What is the primary purpose of the 'conv=noerror,sync' option in this context?

Accepted Answer

To skip bad sectors and continue imaging, padding the output with zeros. The 'conv=noerror,sync' option tells dd to continue reading even when it encounters read errors (noerror) and to pad the output with zeros (sync) to maintain the correct offset alignment, ensuring the image remains a bit-for-bit copy of the source drive despite bad sectors. This is critical in forensic imaging to preserve the integrity of the data stream and avoid truncation or corruption of the output file.

Answer

To split the image into multiple smaller files

Answer

To compress the output image file

Answer

To verify the image integrity using a hash

Question 6

During a forensic investigation, an analyst discovers that the suspect's hard drive was encrypted using BitLocker. The analyst has obtained the recovery key. Which of the following is the best next step to ensure data integrity?

Accepted Answer

Create a forensic image of the encrypted drive, then decrypt the image.. Creating a forensic image of the encrypted drive before decryption preserves the original evidence in its pristine, unaltered state. Decrypting the image later using the recovery key ensures that the original encrypted data remains intact and verifiable, maintaining data integrity throughout the investigation.

Answer

Decrypt the drive using the recovery key and then create a forensic image.

Answer

Run a live analysis tool to extract encryption keys from memory.

Answer

Boot the suspect computer and copy files to an external drive.

Question 7

Which TWO of the following are common challenges specific to cloud forensics?

Accepted Answer

Multi-tenancy issues. Multi-tenancy complicates data isolation, and data jurisdiction affects legal access to data across regions.

Answer

Inability to create disk images

Answer

Permanent data deletion recovery

Answer

Lack of forensic tools

Question 8

A forensic analyst is examining a Mac system for evidence of malicious activity. Which THREE artifacts are commonly analyzed in macOS forensics?

Accepted Answer

Unified logging. macOS forensics frequently examines unified logs (for system events), .plist files (for configuration and application data), and FSEvents (for file system change history). bash_history is not the default for macOS (zsh is default). Prefetch files are Windows-only.

Answer

Prefetch files

Answer

bash_history

Question 9

Which hashing algorithm is commonly used in forensic imaging to verify the integrity of evidence and is considered more secure than MD5?

Accepted Answer

SHA-256. SHA-256 is the correct answer because it is a widely adopted cryptographic hash function in forensic imaging tools (e.g., FTK Imager, EnCase) to verify evidence integrity. It produces a 256-bit (32-byte) hash value and is considered collision-resistant, making it significantly more secure than MD5, which has known collision vulnerabilities.

Answer

SHA-1

Answer

CRC32

Answer

MD5

Question 10

A forensic examiner is presented with evidence that a suspect's computer was used to commit a fraud. The defense argues that the evidence was obtained without a warrant. Which US Constitutional Amendment is MOST relevant to this argument?

Accepted Answer

Fourth Amendment. The Fourth Amendment protects against unreasonable searches and seizures and requires warrants supported by probable cause.

Answer

First Amendment

Answer

Sixth Amendment

Answer

Fifth Amendment

Question 11

A security analyst runs the command `regshot64.exe compare` after executing malware. Regshot reports that the following registry key was created: `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SecureUpdate`. Which conclusion is MOST likely?

Accepted Answer

The malware installed a persistence mechanism. The registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SecureUpdate` is a standard Windows Run key, which automatically executes the specified program at user logon. By creating this key, the malware ensures it runs every time the user logs in, establishing persistence. This is a classic persistence mechanism, not an action related to encryption, file deletion, or network changes.

Answer

The malware encrypted the user's documents

Answer

The malware deleted a system file

Answer

The malware modified a network configuration

Question 12

Which of the following is a primary challenge in cloud forensics due to shared infrastructure?

Accepted Answer

Multi-tenancy and data comingling. Multi-tenancy means multiple customers share the same physical resources. This complicates evidence isolation and can lead to data comingling, making forensic acquisition difficult.

Answer

Slow internet speeds

Answer

Lack of logging capabilities

Answer

Inability to perform network analysis

Question 13

During malware analysis, an investigator finds that a suspicious process is injecting code into a legitimate system process (e.g., explorer.exe). Which technique is being used?

Accepted Answer

Code injection. Code injection is the correct answer because the scenario describes a process injecting arbitrary code into a legitimate system process like explorer.exe. This is the generic term for techniques where malicious code is written into the address space of another process and executed, often via Windows API calls such as WriteProcessMemory and CreateRemoteThread. The question explicitly states 'injecting code,' which directly maps to the broad category of code injection, not a specific subtype.

Answer

API hooking

Answer

Process hollowing

Answer

DLL injection

Question 14

A first responder arrives at a crime scene where a computer is turned on. What should the responder do FIRST?

Accepted Answer

Photograph the scene and document everything. The first priority at a live crime scene is to preserve the state of the evidence through proper documentation and photography. This ensures an accurate record of the computer's condition, including screen contents, peripheral connections, and environmental context, before any volatile data is lost or altered. The CHFI methodology emphasizes that documentation precedes any seizure or data acquisition steps to maintain chain of custody and evidentiary integrity.

Answer

Run antivirus software to check for malware

Answer

Immediately disconnect the power cord

Answer

Copy all files from the hard drive

Question 15

You are a forensic investigator responding to a data breach at a mid-sized company. The company uses a hybrid cloud environment with AWS for production workloads and on-premises servers for legacy applications. The breach was detected when an internal monitoring system flagged unusual outbound traffic from an AWS EC2 instance (i-0a1b2c3d4e5f) to an external IP address (198.51.100.20) on TCP port 4444 during off-hours. The EC2 instance runs a Linux-based web server. The security team has already isolated the instance by removing its security group rules and stopping the instance. You have been provided with the following: (1) AWS CloudTrail logs for the past 72 hours, (2) VPC Flow Logs for the same period, (3) a snapshot of the instance’s root volume (EBS), and (4) the instance metadata log from the AWS console. The company’s incident response policy requires preservation of all volatile data before powering off the instance. Which of the following steps should you take FIRST to ensure a forensically sound investigation?

Accepted Answer

Create a forensic copy of the EBS snapshot and attach it to a separate analysis EC2 instance in a different AWS account to avoid altering evidence.. The first step in a forensically sound investigation is to create a forensic copy (bit-for-bit) of the EBS snapshot before any analysis. This preserves the original evidence integrity, as required by the order of volatility and chain of custody. Attaching the copy to a separate analysis EC2 instance in a different AWS account prevents accidental modification of the original snapshot and isolates the forensic environment from the compromised production account.

Answer

Acquire a memory dump from the stopped instance by re-attaching the root volume to a forensic workstation.

Answer

Review the instance metadata log to identify the user who launched the instance.

Answer

Analyze the VPC Flow Logs to determine if other instances communicated with the same external IP.