CHFI Practice Test 43 — 15 Questions

Question 1

An investigator needs to analyze a Microsoft Outlook PST file from a suspect's computer. Which of the following tools is specifically designed for parsing and extracting emails, attachments, and metadata from PST files in a forensically sound manner?

Accepted Answer

Aid4Mail. Aid4Mail is a forensic email analysis tool that supports PST file parsing and extraction.

Answer

DBXtract

Answer

MailXaminer

Answer

OutlookSpy

Question 2

Which of the following is a unique challenge in cloud forensics compared to traditional digital forensics?

Accepted Answer

Multi-tenancy and data isolation. Multi-tenancy (multiple customers sharing the same physical infrastructure) is a key challenge in cloud forensics because isolating evidence and maintaining data privacy across tenants is difficult.

Answer

Encryption of data at rest

Answer

Lack of network connectivity

Answer

Inability to acquire disk images

Question 3

An email forensic analyst receives a suspicious email and wants to trace its origin. Which email header field provides the most reliable information about the IP address of the sending SMTP server?

Accepted Answer

Received. The 'Received' header is added by each SMTP server that handles the email, and the last 'Received' header (or the first after the client) contains the originating IP.

Answer

Return-Path

Answer

DKIM-Signature

Answer

X-Originating-IP

Question 4

A forensic analyst is examining a Windows system for evidence of USB device usage. Which TWO registry locations are known to store USB device history?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. USB device history is stored in USBSTOR and MountPoints2 keys.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Prefetch

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKLM\SAM\SAM\Domains\Account\Users

Question 5

A forensic analyst finds an LNK file on a Windows system pointing to a script located in a temporary folder. The LNK file's timestamps show creation time after the script's known execution time. What does this discrepancy likely indicate?

Accepted Answer

The LNK file was planted by an attacker to mislead timeline analysis. LNK files are created when a file is accessed through certain methods; if the LNK creation time is after execution, it may have been created manually or by malware to hide evidence.

Answer

The system clock was changed

Answer

The file system is corrupted

Answer

The script was executed normally

Question 6

During a network forensic investigation, an analyst examines a pcap file and finds multiple TCP SYN packets sent to a target IP on port 80, each from a different source IP address. No SYN-ACK packets are returned, but the target continues to send SYN-ACK responses for earlier packets. What attack is MOST likely occurring?

Accepted Answer

SYN flood attack. A SYN flood attack sends many SYN packets without completing the handshake, exhausting the target's connection queue. The different source IPs indicate a distributed SYN flood or IP spoofing.

Answer

UDP flood attack

Answer

ARP spoofing attack

Answer

DNS amplification attack

Question 7

Which tool is specifically designed for timeline analysis of forensic artifacts across multiple systems and can process output from various forensic tools?

Accepted Answer

log2timeline. log2timeline (Plaso) is a tool for creating super timelines from multiple log and artifact sources, enabling analysis of events across time.

Answer

Autopsy

Answer

Wireshark

Answer

Sleuth Kit

Question 8

An analyst discovers a suspicious file named 'cmd.aspx' in the uploads directory of an IIS web server. Analysis reveals the file contains code to execute system commands. What is this file most likely?

Accepted Answer

A web shell. A file with .aspx extension that executes commands is a webshell, allowing remote command execution on the server.

Answer

A log file

Answer

A benign configuration file

Answer

A backup of a legitimate page

Question 9

In an Azure environment, a forensic analyst needs to identify which user assigned a specific role to another user, leading to privilege escalation. Which Azure log should the analyst examine?

Accepted Answer

Azure Activity Log. Azure Activity Log captures all write operations (PUT, POST, DELETE) on Azure resources, including role assignments, making it the primary source for investigating privilege escalation.

Answer

Azure AD Sign-In Logs

Answer

Azure Diagnostic Logs

Answer

Azure Network Watcher Logs

Question 10

A security analyst reviews Apache access logs and finds the following entry: `192.168.1.10 - - [12/Jul/2024:10:15:30 -0400] "GET /search.php?q=1' UNION SELECT username,password FROM users-- HTTP/1.1" 200 5321 "-" "Mozilla/5.0"`. Which attack technique is most likely being attempted?

Accepted Answer

SQL injection. The log entry shows a SQL injection payload (the UNION SELECT statement) in the query parameter. This is a classic SQL injection attempt.

Answer

Remote file inclusion

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Question 11

A forensic analyst is investigating a suspected data exfiltration from a MySQL database. Which log source would be MOST useful to identify the exact SQL queries executed, including SELECT statements that retrieved large volumes of data?

Accepted Answer

MySQL general query log. MySQL's general query log records all SQL queries, including SELECT statements. The binary log records changes (INSERT, UPDATE, DELETE) for replication and recovery, not SELECT queries. Audit logs may be enabled but are not as detailed for SELECT queries by default.

Answer

MySQL error log

Answer

MySQL binary log

Answer

MySQL slow query log

Question 12

Which of the following email authentication protocols uses a digital signature to verify the sender's domain and that the email has not been tampered with?

Accepted Answer

DKIM. DKIM (DomainKeys Identified Mail) uses a digital signature to authenticate the email's domain and integrity.

Answer

DMARC

Answer

SPF

Answer

STARTTLS

Question 13

In Docker forensics, which of the following commands would you use to inspect the history of an image, including the commands that created each layer?

Accepted Answer

docker history. The 'docker history' command shows the history of an image, listing each layer and the command that created it.

Answer

docker image ls

Answer

docker logs

Answer

docker inspect

Question 14

A forensic examiner is analyzing a Linux system suspected of being used as a C2 server. Which THREE artifacts should the examiner prioritize to find evidence of command execution and persistence? (Select three.)

Accepted Answer

~/.bash_history. Bash history shows commands typed by the user. Auth.log may show reverse shell connections. Cron jobs are common persistence mechanisms. Syslog is too broad, and /etc/passwd shows users but not execution.

Answer

/var/log/syslog

Answer

/etc/passwd

Question 15

A Linux system is suspected of being used as a pivot point. An analyst checks /proc/[pid]/fd/ and sees open file descriptors pointing to sockets. Which command would BEST determine the remote connections associated with these sockets?

Accepted Answer

lsof -i. lsof -i shows network connections and listening sockets, including remote addresses. It can read /proc fd info.

Answer

netstat -anp

Answer

cat /proc/net/tcp

Answer

ls -la /proc/[pid]/fd/