CHFI Practice Test 45 — 15 Questions

Question 1

A malware analyst is analyzing a suspicious executable. Which THREE of the following are valid indicators of compromise (IoCs) that can be extracted from static analysis of the PE file? (Select THREE)

Accepted Answer

IP addresses from embedded strings. Option A is correct because static analysis of a PE file routinely includes extracting embedded strings, and hardcoded IP addresses or URLs found in the binary are classic network-based IoCs that can be used for blocking and detection. Option C is correct because the MD5 hash of the file is a cryptographic file-based IoC computed directly from the sample without executing it, allowing analysts to pivot in threat-intelligence platforms and write hash-based detection rules. Option E is correct because the PE import table is parsed statically, and the list of imported DLLs and functions (e.g., CreateRemoteThread, VirtualAllocEx, WinINet APIs) reveals capabilities and is a valid host/behavioral IoC used in YARA and hunting rules. Option B is not correct because registry keys modified during execution can only be observed through dynamic analysis (e.g., Procmon, Regshot), not from static inspection of the PE file. Option D is not correct because file paths created during execution are also runtime artifacts revealed by dynamic analysis or sandboxing, not extractable from the static structure of the executable.

Answer

Registry keys modified during execution

Answer

File paths created during execution

Question 2

During dynamic analysis of a malware sample, an analyst observes the following: creation of a mutex named `Global\{9A2D7E1C-3F4B-4A5E-9B8C-1D2E3F4A5B6C}`, a registry key under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` named `WindowsUpdate`, and outbound TCP traffic to `203.0.113.5:443`. Which THREE of the following indicators of compromise (IoCs) should be documented?

Accepted Answer

Outbound TCP to `203.0.113.5:443`. Option A is correct because the observed outbound TCP connection to 203.0.113.5:443 is a network-based IoC that can be used for detection, blocking, and threat hunting, and the specific IP and port should be documented exactly as observed. Option C is correct because the mutex name Global\{9A2D7E1C-3F4B-4A5E-9B8C-1D2E3F4A5B6C} is a host-based IoC; mutexes are often unique to a malware family or campaign and can be used to identify infection or prevent reinfection. Option E is correct because the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate is a persistence IoC, since the Run key causes the named value to execute at user logon and should be documented for detection and remediation. Option B is not among the observed dynamic behaviors listed in the scenario, even though a sample hash is useful context, and Option D is a legitimate Windows system file path that is not an IoC in this scenario.

Answer

SHA256 hash of the malware sample

Answer

File path `C:\Windows\System32
otepad.exe`

Question 3

An analyst is performing dynamic analysis of a malware sample in Cuckoo Sandbox. Which TWO of the following are typical indicators of command and control (C2) communication?

Accepted Answer

The malware performs DNS queries to a domain that resolves to a known malicious IP. Option B is correct because DNS queries to a domain resolving to a known malicious IP are a classic C2 indicator: the malware must locate its controller, and threat-intel feeds flag such resolutions as beaconing to adversary infrastructure. Option E is correct because HTTP POST requests to a newly registered domain (2 days old) fit the C2 profile of exfiltrating victim data or receiving tasking over web protocols, and domain age is a strong reputation signal for malicious infrastructure. Option A is not a C2 indicator but a persistence technique via the Registry Run key. Option C describes system file modification, which indicates tampering or defense evasion rather than network C2. Option D describes mutex creation, which is typically used for single-instance checks or host-based sandbox-evasion markers, not command-and-control traffic.

Answer

The malware creates a registry run key for persistence

Answer

The malware modifies system files in C:\Windows\System32

Answer

The malware creates a mutex named 'Global\MyMutex'

Question 4

A forensic analyst is performing static analysis of a Windows PE file. Which TWO of the following tools are specifically designed for static analysis of malware?

Accepted Answer

IDA Pro. IDA Pro (C) is a disassembler and debugger specifically built for reverse engineering binary executables, allowing an analyst to statically examine a PE file's code, imports, and structure without executing it. Ghidra (D) is the NSA's open-source software reverse engineering suite that likewise performs static disassembly and decompilation of PE files, making it a core static malware analysis tool. Both operate on the file on disk, matching the scenario's requirement for static analysis. Wireshark (A) is a network protocol analyzer that inspects captured traffic, not PE binaries. Cuckoo Sandbox (B) is a dynamic analysis platform that executes malware in an isolated VM and observes behavior, so it is not static. Process Monitor (E) is a live runtime monitoring tool for file, registry, and process activity, also dynamic rather than static.

Answer

Wireshark

Answer

Cuckoo Sandbox

Answer

Process Monitor

Question 5

A forensic examiner is analyzing an iOS device backup and wants to extract the user's iCloud-related artefacts. Which TWO of the following are typical sources of iCloud artefacts in an iTunes backup?

Accepted Answer

com.apple.accounts.plist. Option B, com.apple.accounts.plist, is correct because this property list stores the device's configured account information, including iCloud account identifiers and settings, making it a primary source of iCloud-related artefacts in an iTunes backup. Option D, the Keychain database (keychain-backup.plist), is correct because iCloud credentials and tokens are protected within the keychain, and the backup's keychain-backup.plist preserves these secrets for forensic examination. Option A, AddressBook.db, is incorrect because it holds local contact data rather than iCloud account artefacts. Option C, Call_history.db, is incorrect because it contains call log records, not iCloud configuration or credential data. Option E, SMS.db, is incorrect because it stores text message data, which is unrelated to iCloud account artefacts.

Answer

AddressBook.db

Answer

Call_history.db

Answer

SMS.db

Question 6

A security team is investigating a suspected Advanced Persistent Threat (APT) intrusion. They have identified several IoCs. Which THREE of the following are considered standard types of Indicators of Compromise?

Accepted Answer

IP address of a command and control server. Option B is correct because the IP address of a command and control (C2) server is a classic network-based IoC that defenders use to detect beaconing or outbound connections to attacker infrastructure. Option C is correct because an MD5 hash of a malicious executable is a file-based (hash) IoC that uniquely identifies known malware samples and enables blocklisting or scanning. Option D is correct because a registry key path used for persistence is a host-based IoC, since attackers commonly abuse Run keys, Services, or similar registry locations to survive reboots. Option A is not a standard IoC type because employee badge numbers are identity/HR data, not technical artifacts of compromise. Option E is not a standard IoC type because an email subject line is contextual phishing content, not a reliable technical indicator such as a hash, IP, domain, URL, or registry artifact.

Answer

Employee badge number

Answer

Email subject line from a phishing campaign

Question 7

A forensic analyst is examining an Android device for evidence of a specific app's usage. Which TWO locations are MOST likely to contain app-specific data that can be recovered through a logical acquisition?

Accepted Answer

/data/data/. Option B (/data/data/) is correct because this is the primary internal storage path where Android stores each app's private data, including databases, shared preferences, and cache files, and on a rooted or debuggable device it can be captured during a logical acquisition. Option C (/mnt/sdcard/Android/data/) is correct because it is the app-specific external storage directory (also referenced as /sdcard/Android/data/ or /storage/emulated/0/Android/data/) where apps place user- and app-generated files such as downloads, media, and OBB assets that are recoverable via logical extraction. Option A (/system/bin/) is not app-specific data but the read-only system partition containing OS binaries and shell tools. Option D (/proc/) is a virtual kernel filesystem exposing runtime process and system state, not persistent app evidence. Option E (/init.rc) is the Android init startup script defining boot-time services and actions, not user app data.

Answer

/system/bin/

Answer

/proc/

Answer

/init.rc

Question 8

An incident responder is analyzing a compromised Windows workstation. Which TWO artifacts would provide the STRONGEST evidence of a malware persistence mechanism?

Accepted Answer

Registry Run key referencing a suspicious path. Option B is correct because the Windows Registry Run keys (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run or HKLM\...\Run) are a classic autostart location that causes a program to execute automatically at user logon or system boot, so a Run key referencing a suspicious path is direct evidence of a persistence mechanism. Option C is correct because a Scheduled Task (stored under C:\Windows\System32\Tasks and managed via schtasks.exe or the Task Scheduler service) configured to launch a malicious executable is an explicit, recurring persistence technique that survives reboots and often runs with elevated privileges. Option A is not the strongest evidence because a user login event (e.g., Event ID 4624 in the Security log) only shows authentication activity and does not itself establish persistence. Option D is not the strongest evidence because network share access logs record file access over SMB and do not demonstrate an autostart or persistence configuration. Option E is not the strongest evidence because browser history showing a suspicious download indicates possible initial infection or delivery, not an established persistence mechanism.

Answer

Event log entry for user login

Answer

Network share access logs

Answer

Browser history showing download of a suspicious file

Question 9

Which THREE of the following are common indicators of compromise (IoCs) that can be used to detect malware infections?

Accepted Answer

Registry key created by malware for persistence. Option C is correct because malware frequently establishes persistence by creating or modifying registry keys (for example, under HKCU\Software\Microsoft\Windows\CurrentVersion\Run or as a service entry), and such unauthorized registry changes are a classic host-based IoC. Option D is correct because cryptographic file hashes such as MD5 or SHA-256 uniquely identify known malicious files, allowing defenders to scan endpoints and compare against threat-intelligence hash feeds. Option E is correct because the IP address of a command-and-control (C2) server is a network-based IoC that can be blocked at the firewall or detected in proxy, DNS, and NetFlow logs to reveal infected hosts beaconing out. Options A and B are not IoCs: a user's favorite color and the brand of a victim's computer are irrelevant personal or hardware attributes that provide no technical evidence of malware activity.

Answer

The user's favorite color

Answer

The brand of the victim's computer

Question 10

A malware analyst is performing dynamic analysis of a suspicious executable in a Cuckoo Sandbox environment. Which THREE of the following behavioural indicators would be considered suspicious and warrant further investigation?

Accepted Answer

Creating a mutex with a hardcoded name. Option A is correct because creating a mutex with a hardcoded name is a classic malware behavior used to prevent multiple instances of the same infection from running simultaneously, and the specific name can serve as a host-based indicator of compromise (IOC) for detection and family identification. Option C is correct because modifying the hosts file to redirect a domain is a common technique for DNS hijacking, blocking security vendor updates, or redirecting legitimate traffic to attacker-controlled infrastructure, and it is highly suspicious in a sandbox run. Option E is correct because connecting to an IP address associated with a known command-and-control (C2) server is a direct indicator of malicious beaconing and exfiltration activity, and it is one of the strongest network-level IOCs in dynamic analysis. Option B is not suspicious because reading registry keys under HKLM\HARDWARE is a routine operation performed by many legitimate applications and drivers to enumerate hardware configuration. Option D is not suspicious because writing a temporary file to %TEMP% is normal behavior for a wide range of benign installers, updaters, and applications, so it does not by itself warrant further investigation.

Answer

Reading registry keys under HKLM\HARDWARE

Answer

Writing a temporary file to %TEMP%

Question 11

Which TWO of the following are essential components of chain of custody documentation?

Accepted Answer

Every person who handled the evidence must sign and date the form. Option A is correct because chain of custody requires an unbroken, auditable record of possession, so every individual who handled the evidence must sign and date the form to establish accountability and continuity. Option B is correct because the evidence must be uniquely and precisely identified—including make, model, and serial number—so it can be distinguished from similar items and matched to the custody entries. Option C is not essential to chain of custody itself; the forensic tool used belongs to the analysis methodology and is documented in the examination report, not the custody log. Option D is not required; evidence must be secured against tampering, but a fireproof safe is a storage recommendation, not a chain-of-custody component. Option E is not part of chain of custody; the final analysis report documents findings and conclusions, not the chronological transfer and handling of the evidence.

Answer

The forensic tool used to analyze the evidence

Answer

The evidence must be stored in a fireproof safe

Answer

The final analysis report

Question 12

A forensic investigator is analyzing a Windows system suspected of malware infection. Which THREE of the following are common persistence mechanisms that malware may use?

Accepted Answer

Scheduled Tasks via schtasks. Scheduled Tasks via schtasks (A) are a common persistence mechanism because malware can register a task with the Task Scheduler service to execute its payload at logon, on a schedule, or on system events, surviving reboots. Creating a Windows service (B) is also a classic persistence technique, since services configured with auto-start (e.g., via sc.exe create or the Service Control Manager) launch automatically at boot under a privileged account. The Run key at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (E) is a well-known autostart location that Windows reads at user logon to launch listed programs, making it a favorite for malware persistence. Adding an entry to the hosts file (C) is not a persistence mechanism; it only redirects DNS resolution and does not cause code to execute. Modifying boot.ini (D) is not applicable to modern Windows systems, which use the Boot Configuration Data (BCD) store, and boot.ini was used only on legacy BIOS-based Windows XP/2003 systems.

Answer

Adding an entry to the hosts file

Answer

Modifying the boot.ini file

Question 13

A first responder arrives at a crime scene where a computer is running. Which THREE actions should the first responder take to preserve volatile evidence?

Accepted Answer

Collect contents of RAM using a tool like FTK Imager or dd. Option A is correct because RAM contents are highly volatile and lost on power-off, so capturing memory with a tool like FTK Imager or dd preserves running processes, encryption keys, and other in-memory artifacts. Option C is correct because netstat records active network connections and listening ports, which are volatile and can reveal remote sessions or exfiltration activity before they disappear. Option E is correct because photographing the screen captures the current visual state of the running system, including open windows and displayed data, without altering the machine. Option B is not appropriate because unplugging the power cord immediately destroys volatile evidence such as RAM and active connections. Option D is not appropriate because running an antivirus scan modifies the system, overwrites volatile data, and can destroy evidence rather than preserve it.

Answer

Unplug the power cord immediately

Answer

Run a full antivirus scan on the system

Question 14

Which TWO of the following are valid reasons for a first responder to power off a computer system at a crime scene? (Select TWO)

Accepted Answer

When the system is actively destroying evidence (e.g., a data wiping program is running). Option C is correct because if a system is actively destroying evidence—such as a running data-wiping utility, a secure-delete routine, or malware with a timed deletion payload—the first responder must immediately remove power to halt the ongoing destruction, since normal shutdown procedures would allow the process to continue and complete. Option E is correct because when a computer poses an immediate physical danger to responders, such as being part of a bomb trigger circuit or located in a hazardous environment (fire, toxic gas, explosive atmosphere), life safety overrides evidence preservation and the system should be powered off. Option A is not a valid reason because speed or convenience never justifies altering a crime scene, and proper evidence handling takes precedence over saving time. Option B is not valid because transportability is irrelevant to the decision to power off; systems can be transported while powered or properly packaged without using shutdown as a transport aid. Option D is incorrect because it is factually backwards: powering off destroys volatile data (RAM contents, running processes, network connections, encryption keys in memory), whereas capturing volatile data requires the system to remain powered on and follow the order of volatility.

Answer

To save time during the investigation

Answer

To make it easier to transport the system

Answer

To prevent the destruction of volatile data by allowing it to be captured before shutdown

Question 15

According to the US Fourth Amendment, which of the following THREE conditions generally allow law enforcement to search and seize digital evidence without a warrant? (Select THREE)

Accepted Answer

Consent given voluntarily by the owner of the device. Option A is correct because voluntary consent from a person with authority over the device (owner or someone with common authority) is a well-established exception to the Fourth Amendment warrant requirement, provided the consent is freely and voluntarily given. Option C is correct because exigent circumstances, such as the imminent destruction of digital evidence (e.g., a suspect wiping a drive or remote-wiping a phone), permit warrantless seizure or search when obtaining a warrant would be impracticable and the officers did not create the exigency. Option E is correct because the plain view doctrine allows warrantless seizure of evidence when an officer is lawfully present, the incriminating character of the item is immediately apparent, and the officer has a lawful right of access to the item. Option B is incorrect because being a minor does not by itself create a warrant exception; juveniles retain Fourth Amendment protections and typically require a warrant, parental consent, or another recognized exception. Option D is incorrect because encryption and refusal to provide a key do not authorize a warrantless search; instead, they may trigger compelled decryption litigation or other legal process, and the Fifth Amendment may even protect against self-incrimination.

Answer

The suspect is a minor

Answer

The data is encrypted and the key is not provided