CHFI Practice Test 44 — 15 Questions

Question 1

During a forensic examination of a macOS system, an investigator wants to review application execution history. Which artifact contains a chronological record of application launches, including timestamps and process IDs?

Accepted Answer

Unified logging (log command). macOS unified logging provides detailed system activity including application launches. FSEvents records file system changes but not process launches. .plist files may store settings, not execution history.

Answer

FSEvents

Answer

com.apple.launchd.plist

Answer

syslog

Question 2

Which network forensic tool is BEST suited for analyzing NetFlow data to identify top talkers and detect anomalies?

Accepted Answer

SiLK. SiLK (System for Internet-Level Knowledge) is a set of NetFlow analysis tools designed for large-scale flow data analysis, including identifying top talkers and anomaly detection.

Answer

tcpdump

Answer

Nmap

Answer

Wireshark

Question 3

Which TWO of the following are forensic artifacts found on macOS systems that can help reconstruct user activity?

Accepted Answer

.plist files. Unified logging captures detailed system and user activity logs, and .plist files store application preferences and usage data. Both are valuable for reconstructing user actions.

Answer

Prefetch files (*.pf)

Answer

Registry hive files

Answer

Event ID 4624

Question 4

A forensic examiner needs to analyze a Microsoft Outlook PST file from a suspect's computer. Which tool is BEST suited to parse and extract emails, attachments, and metadata from the PST file?

Accepted Answer

Aid4Mail. Aid4Mail is a professional email forensic tool that can parse PST files and extract all components including metadata, attachments, and headers.

Answer

DB Browser for SQLite

Answer

MailXaminer

Answer

Outlook Express

Question 5

Which TWO of the following are indicators of a webshell attack found in web server logs? (Select TWO)

Accepted Answer

Requests to a .asp or .php file with parameters like cmd or exec. Webshells often involve file uploads to directories like uploads, and subsequent requests to that file with parameters indicating command execution (e.g., cmd=).

Answer

Abnormal HTTP methods like OPTIONS or TRACE

Answer

High volume of traffic from a single IP

Answer

Frequent 404 errors for non-existent pages

Question 6

Which of the following email headers is used to verify the domain of the sending server and is commonly used for authentication to prevent spoofing?

Accepted Answer

DKIM-Signature. The DKIM-Signature header contains a cryptographic signature that allows the receiver to verify that the email was not modified and is from the claimed domain, helping prevent spoofing.

Answer

Content-Type

Answer

Received

Answer

X-Mailer

Question 7

Which TWO of the following are common challenges specific to cloud forensics? (Select TWO)

Accepted Answer

Data jurisdiction and legal compliance. Multi-tenancy (shared infrastructure) and data jurisdiction (where data is physically stored) are unique to cloud forensics, unlike physical or virtual environments.

Answer

Volatile memory acquisition

Answer

Inability to image hard drives

Answer

Lack of proper tools

Question 8

Which cloud forensic challenge refers to the inability to physically access the storage media where data resides?

Accepted Answer

Lack of physical access. Volatility of evidence relates to the ephemeral nature of cloud data. Multi-tenancy is about shared resources. Data jurisdiction is legal. Lack of physical access is a key challenge.

Answer

Data jurisdiction

Answer

Multi-tenancy

Answer

Volatility of evidence

Question 9

During an email forensics investigation, an analyst examines headers and sees `Received: from mail.evil.com (192.168.1.100) by mail.victim.com` followed by `DKIM-Signature: v=1; a=rsa-sha256; d=evil.com; s=selector; bh=...; h=...; b=...`. The email claims to be from support@paypal.com. Which finding is the strongest indicator of spoofing?

Accepted Answer

The DKIM signature domain is evil.com, not paypal.com. The DKIM-Signature domain (evil.com) does not match the claimed sender domain (paypal.com). This mismatch indicates the email is likely spoofed.

Answer

The email was received via SMTP

Answer

The email lacks a SPF record in the header

Answer

The email originated from IP 192.168.1.100

Question 10

In an AWS environment, a security analyst detects unusual API calls that created several IAM users with administrative privileges from an unfamiliar IP address. Which AWS service log should be examined first to identify the specific API calls and the IAM user that made them?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made to the AWS environment, including IAM user creation. It provides details like the source IP, user identity, and the specific API action.

Answer

Amazon S3 access logs

Answer

AWS CloudWatch Logs

Answer

AWS Config

Question 11

A forensic examiner recovers a Windows 10 system and finds a prefetch file for powershell.exe with a last run time of 3 days ago, but the system's security logs show no interactive logons from that user. What does this discrepancy suggest?

Accepted Answer

PowerShell was executed as part of a scheduled task or service. Prefetch files record execution times. If PowerShell ran but no interactive logon, it likely ran via a scheduled task or service, which doesn't create an interactive logon event (Event ID 4624 with logon type 2).

Answer

The prefetch file is corrupted

Answer

The user deleted their profile

Answer

The system clock was changed

Question 12

A Linux investigator wants to see all commands run by a user from the bash shell. Which file should be examined?

Accepted Answer

~/.bash_history. The .bash_history file in the user's home directory contains the command history for bash.

Answer

/etc/passwd

Answer

/var/log/auth.log

Answer

/var/log/syslog

Question 13

A security analyst reviews Windows Security Event Log and finds multiple Event ID 4625 entries for a single user account within a few seconds. What does this pattern MOST likely indicate?

Accepted Answer

Brute-force password attack. Event ID 4625 indicates a failed logon attempt. Multiple rapid failures suggest a brute-force password guessing attack.

Answer

Service installation

Answer

Account creation

Answer

Successful logon by the user

Question 14

A cloud forensics investigator is analyzing an incident in AWS. The suspect is alleged to have deleted an S3 bucket. Which AWS service log would contain the DeleteBucket API call details, including the source IP and user identity?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made to the AWS environment, including S3 bucket deletions. It logs the identity, source IP, and request parameters.

Answer

VPC Flow Logs

Answer

Amazon S3 access logs

Answer

AWS Config

Question 15

A security analyst is investigating a containerized application running on a Docker host. The analyst needs to collect forensic evidence from a stopped container without starting it. Which of the following Docker commands should be used to export the container's filesystem as a tar archive?

Accepted Answer

docker export. docker export exports the container's filesystem as a tar archive. It works on stopped or running containers and does not require the container to be started.

Answer

docker commit

Answer

docker cp

Answer

docker save