CHFI Practice Test 42 — 15 Questions

Question 1

An analyst is investigating a potential data breach on an Android device. Which TWO artefacts are MOST useful for determining which third-party apps were installed and used? (Select TWO.)

Accepted Answer

packages.xml file in /data/system/. The packages.xml file in /data/system/ records all installed packages, including third-party apps, their permissions, and installation metadata. The /data/data/ directory contains per-package subdirectories with application-specific data, confirming actual usage and stored data. Together, these two artefacts provide definitive evidence of which third-party apps were installed and used on the device.

Answer

Full system dump (dd image)

Answer

Wi-Fi connection logs

Answer

SMS database (mmssms.db)

Question 2

During a forensic investigation, an analyst discovers data hidden in the Host Protected Area (HPA) of a hard drive. Which tool is commonly used to view and access the HPA?

Accepted Answer

hdparm. D (hdparm) is correct because the Host Protected Area (HPA) is a reserved area on an ATA/IDE hard drive that can be accessed and manipulated using ATA commands. The hdparm utility in Linux provides the -N flag to view and change the HPA size, allowing an analyst to detect and access hidden data stored in this region.

Answer

PhotoRec

Answer

fdisk

Answer

dd

Question 3

Which THREE of the following are commonly used for persistence on a Windows system? (Choose THREE.)

Accepted Answer

Registry Run keys. Registry Run keys (B) are a classic Windows persistence mechanism because entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Run or HKLM\...\Run are automatically executed at user logon or system startup. Service installations (C) provide persistence by registering a service with the Service Control Manager (e.g., via sc.exe create or New-Service), allowing malicious code to run at boot under a privileged context. Scheduled tasks (E) persist by creating a task through schtasks.exe or the Task Scheduler COM API that triggers execution at logon, startup, or on a schedule. LNK files (A) are shortcut files that can execute payloads when clicked but are not an automatic persistence mechanism by themselves, and Prefetch files (D) are forensic artifacts generated by the Windows prefetcher to speed up application launches, not a persistence technique.

Answer

LNK files

Answer

Prefetch files

Question 4

A security analyst is investigating a phishing email and notices the DKIM-Signature header is present but fails validation. Which TWO actions should the analyst take?

Accepted Answer

Check the DKIM DNS record for the signing domain. DKIM failure indicates the email may be forged or tampered with. Checking the domain's DKIM DNS record and examining the email headers for other spoofing indicators are appropriate steps.

Answer

Ignore the DKIM failure as it is not important

Answer

Reply to the sender to verify authenticity

Answer

Delete the email immediately

Question 5

You are investigating a network breach at a financial institution. The organization uses a network-based intrusion detection system (NIDS) and maintains full packet capture (PCAP) for critical segments. The incident allegedly started with a spear-phishing email that delivered a remote access trojan (RAT). The security team has isolated the infected host and provided you with a disk image of the host and a PCAP file covering the network traffic from the host for the 24-hour period before isolation. In the PCAP, you see a series of TCP connections from the host to an external IP address on port 443 (HTTPS). The external IP is known to be associated with a command-and-control (C2) server. However, the disk image shows no evidence of the RAT binary or any malicious files. The host's antivirus logs are clean. Which of the following is the most likely explanation for the lack of evidence on the disk?

Accepted Answer

The malware was fileless and only resided in memory. The absence of the RAT binary and any malicious files on the disk, combined with clean antivirus logs and active C2 traffic over HTTPS, strongly indicates a fileless malware infection. Fileless malware operates entirely in memory (RAM), never writing its payload to disk, which explains why the disk image shows no artifacts and why traditional file-scanning antivirus did not detect it. The TCP connections to the C2 server on port 443 are consistent with a memory-resident RAT that loads directly into a legitimate process (e.g., PowerShell, WMI, or a script interpreter) and communicates over encrypted HTTPS to evade network inspection.

Answer

The antivirus software deleted the malicious files before the image was taken

Answer

The hard drive was reimaged before the forensic image was taken

Answer

The RAT uses a rootkit to hide its files

Question 6

A security analyst discovers unauthorized access to a server. The incident response team decides to preserve evidence. Which of the following actions is MOST critical to ensure the admissibility of evidence in court?

Accepted Answer

Documenting the chain of custody. Chain of custody documentation is the most critical action for evidence admissibility because it establishes a verifiable record of who handled the evidence, when, and under what conditions, ensuring the evidence has not been tampered with. Without a proper chain of custody, even technically sound evidence can be ruled inadmissible under rules like Federal Rule of Evidence 901. In forensic practice, this involves logging every access with timestamps, digital signatures, and hash values (e.g., SHA-256) to maintain integrity.

Answer

Disconnecting the server from the network

Answer

Running a full antivirus scan on the server

Answer

Taking screenshots of the server's screen

Question 7

During the initial response to a suspected data exfiltration, which THREE pieces of volatile data should be collected first? (Choose three.)

Accepted Answer

Current network connections.. Current network connections (A) are volatile because they show active communication channels that could indicate data exfiltration in progress. If the system is shut down or disconnected, this evidence is lost immediately, making it a top priority for collection during initial response.

Answer

Windows registry hives.

Answer

Forensic image of the hard drive.

Question 8

Which TWO of the following are essential components of a proper chain of custody documentation? (Select TWO.)

Accepted Answer

Date and time of each evidence transfer. Option B is correct because chain of custody documentation must record the date and time of every transfer of evidence, establishing an auditable timeline that proves the evidence was continuously accounted for from seizure to presentation. Option C is correct because each person who handled or transferred the evidence must sign for it, creating individual accountability and showing an unbroken sequence of custody. Together, these entries let investigators demonstrate that the evidence was not tampered with or substituted. Option A is not essential to the chain of custody itself, since the suspect's identity does not establish who controlled the evidence. Option D is irrelevant because the OS version of the suspect's computer is a technical artifact detail, not a custody record. Option E is likewise irrelevant, as the forensic workstation's IP address does not document the handling or transfer of evidence.

Answer

The name of the suspect

Answer

The operating system version of the suspect's computer

Answer

The IP address of the forensic workstation

Question 9

A network analyst captures traffic and sees an HTTP request containing: GET /wp-content/uploads/evil.php?cmd=id HTTP/1.1. Which of the following is MOST likely occurring?

Accepted Answer

Webshell access. The HTTP request `GET /wp-content/uploads/evil.php?cmd=id HTTP/1.1` indicates that the attacker is accessing a PHP file (`evil.php`) in the WordPress uploads directory and passing a command (`cmd=id`) to it. This is a classic indicator of a webshell — a malicious script uploaded to the server that allows remote command execution. The `id` command is a common Unix command used to verify the current user context, confirming the attacker has achieved interactive shell-like access.

Answer

SQL injection attack

Answer

Cross-site scripting (XSS) attack

Answer

Directory traversal attack

Question 10

An investigator examining a compromised web server finds a file named shell.aspx in the uploads directory. The file contains code that accepts commands via HTTP POST and executes them on the server. What is the MOST likely type of attack?

Accepted Answer

Webshell. The file shell.aspx contains code that accepts commands via HTTP POST and executes them on the server, which is the classic definition of a webshell. A webshell is a malicious script uploaded to a web server that provides an attacker with remote command execution capabilities, often used for persistence and post-exploitation activities.

Answer

Server-side request forgery (SSRF)

Answer

SQL injection

Answer

Cross-site request forgery (CSRF)

Question 11

During a forensic investigation, an analyst uses a tool to capture the contents of RAM from a live Linux system. Which tool is specifically designed for this purpose and can acquire memory over a network or via a local kernel module?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is specifically designed to capture RAM from live Linux systems. It can acquire memory either by loading a kernel module locally or by transmitting the memory dump over a network, making it the correct choice for this scenario.

Answer

WinPmem

Answer

FTK Imager

Answer

Volatility

Question 12

Which THREE of the following present unique challenges for forensic analysis of solid-state drives (SSDs) compared to traditional hard disk drives (HDDs)? (Select THREE.)

Accepted Answer

Wear leveling that moves data around the NAND chips. Option B is correct because SSD controllers implement wear leveling, which continuously relocates logical blocks across physical NAND pages to spread erase cycles, so a logical address no longer maps predictably to a fixed physical location and traditional imaging/address-based recovery assumptions break down. Option D is correct because garbage collection runs in the background, copying valid pages into new blocks and erasing blocks containing stale data, which can destroy deleted-file remnants before an examiner images the drive and can alter the drive contents after acquisition. Option E is correct because the TRIM command (ATA DATA SET MANAGEMENT / SCSI UNMAP) notifies the SSD that deleted LBAs are no longer needed, prompting the controller to erase those NAND blocks and making deleted data unrecoverable, unlike HDDs where deleted clusters typically persist until overwritten. Option A is not a unique SSD challenge, since 512-byte sector emulation (512e/4Kn) and slack space issues also arise on modern HDDs and are not specific to flash media. Option C is not unique either, as fragmentation from file system aging occurs on HDDs as well and is actually mitigated on SSDs by the flash translation layer.

Answer

Slack space analysis due to 512-byte sector emulation

Answer

Fragmentation due to file system aging

Question 13

During a forensic investigation, an analyst needs to recover recently deleted files from a FAT32 partition. Which of the following techniques is MOST effective for recovering files whose directory entries have been marked as deleted but the clusters have not yet been overwritten?

Accepted Answer

Using 'dd' to create a raw image and then 'photorec' to recover based on file signatures. In FAT32, deleting a file normally marks the directory entry's first byte as 0xE5 while the data clusters may remain intact. The preferred recovery approach is to use forensic tools that parse the file system metadata (directory entries and FAT), such as Autopsy, FTK, EnCase, or a specialized FAT recovery utility. Manual editing of the directory entry and recalculation of the FAT chain is not a standard CHFI technique and can damage evidence. Among the listed options, creating a raw image with dd and using Photorec is the most forensically sound workflow; Photorec recovers file content by file signatures. It is not as ideal as metadata-based tools when directory entries are available, but it is better than manually modifying the file system structures.

Answer

Running 'scalpel' to extract fragments and reassemble based on metadata

Answer

Using the 'foremost' tool to perform file carving based on file headers and footers

Answer

Editing the directory entry's first byte from 0xE5 to the original character and recalculating the FAT chain

Question 14

A security analyst reviews an Apache access log and finds the entry: '192.168.1.10 - - [10/Mar/2025:08:12:34 +0000] "GET /index.php?id=1 UNION SELECT username,password FROM users-- HTTP/1.1" 200 2345 "-" "Mozilla/5.0"'. Which attack is indicated?

Accepted Answer

SQL injection. The UNION SELECT statement in the URI indicates a SQL injection attack. The attacker is trying to extract data from the database.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Webshell upload

Question 15

Which of the following is a key difference between static and dynamic malware analysis?

Accepted Answer

Static analysis examines code without execution, dynamic analysis executes the sample. Static malware analysis involves examining the malware's code (e.g., disassembly, strings, headers) without executing it, while dynamic analysis runs the sample in a controlled environment (e.g., sandbox, debugger) to observe its runtime behavior. Option C correctly captures this fundamental distinction: static analysis is code-centric and non-executional, whereas dynamic analysis is behavior-centric and executional.

Answer

Static analysis executes the malware, dynamic does not

Answer

Static analysis requires an internet connection, dynamic does not

Answer

Static analysis is always automated, dynamic is manual