CHFI Practice Test 46 — 15 Questions

Question 1

Which THREE of the following are essential steps in the digital forensics investigation process? (Select three.)

Accepted Answer

Examination. The digital forensics investigation process follows a defined sequence of phases, and Collection (D) is essential because it is the phase where potentially relevant data is identified, preserved, and acquired from sources such as disks, memory, and logs using write-blockers and hashing to maintain integrity. Examination (A) is essential because it is where the collected data is filtered, extracted, and reduced to identify only the information relevant to the case, using forensic tools and techniques. Analysis (B) is essential because it is where the examined data is interpreted to answer the investigative questions, establish timelines, attribute actions, and draw conclusions supported by the evidence. Encryption (C) is not a forensic process phase; it is a data-protection technique that may be encountered as an obstacle during examination, not a required step. Destruction (E) is not part of the investigation process either, since evidence must be preserved and retained per legal and chain-of-custody requirements rather than destroyed.

Answer

Encryption

Answer

Destruction

Question 2

Which TWO of the following are valid reasons for using a hardware write blocker over a software write blocker? (Select two.)

Accepted Answer

Hardware write blockers operate at the physical layer and are OS-independent. Option C is correct because hardware write blockers sit inline on the storage interface (e.g., SATA, SAS, USB, or IDE) and enforce write protection at the physical/electrical layer, so they function independently of the operating system and require no drivers or host OS support. Option D is correct because this inline hardware design provides a true physical barrier: write commands are intercepted and blocked before they reach the suspect drive, ensuring the evidence disk cannot be altered. Option A is not a valid reason, since hardware blockers generally do not offer faster transfer speeds than software blockers and speed is not their purpose. Option B is incorrect because a hardware blocker cannot be bypassed by malware on the forensic workstation; that risk applies to software write blockers running on a compromised OS. Option E is incorrect because hardware write blockers are typically more expensive than software write blockers, not cheaper.

Answer

Hardware write blockers support faster transfer speeds than software blockers

Answer

Hardware write blockers can be bypassed by malware on the forensic workstation

Answer

Hardware write blockers are cheaper than software solutions

Question 3

Which TWO of the following are types of write blockers used in forensic imaging? (Select two.)

Accepted Answer

Hardware write blocker. Hardware write blockers (D) are physical devices that sit between the suspect drive and the forensic workstation, intercepting the ATA/SCSI/NVMe command set and permitting only read commands to pass through, which prevents any modification of the evidence drive. Software write blockers (E) are drivers or kernel modules (for example, on Linux, mounting with the read-only option or using tools like the 'blockdev --setro' command) that intercept I/O requests at the OS level and block write operations to the protected device. These two are the recognized categories of write blockers in forensic imaging because they operate at the hardware and software layers respectively. Encryption write blockers (A) are not a write-blocking type — encryption is a data protection mechanism, not a means of preventing writes during acquisition. Network write blockers (B) do not exist as a forensic write-blocker category, since network interfaces are not the medium being protected during imaging. Hash write blockers (C) are also not a real category; hashing (e.g., MD5/SHA-256) is used to verify integrity after imaging, not to block writes.

Answer

Encryption write blocker

Answer

Network write blocker

Answer

Hash write blocker

Question 4

Which THREE of the following are steps in the forensic investigation process? (Select three.)

Accepted Answer

Analysis. In the forensic investigation process, First response (D) is the initial step where the investigator secures the scene, preserves volatile evidence, and documents the state of systems to prevent contamination. Analysis (A) follows, where the collected data is examined using validated tools and techniques to reconstruct events and identify artifacts relevant to the incident. Reporting (C) is the final phase, where findings, methods, and conclusions are documented in a clear, defensible manner suitable for legal or administrative proceedings. Sentencing (B) is a judicial action that occurs after a trial, not part of the forensic investigation itself, and Deletion of irrelevant data (E) is not a recognized step—forensic examiners preserve all potential evidence and may filter for relevance during analysis, but never delete data as part of the process.

Answer

Sentencing

Answer

Deletion of irrelevant data

Question 5

Which THREE of the following are characteristics of the Master File Table ($MFT) in NTFS? (Choose three.)

Accepted Answer

It contains a record for every file and directory on the volume. Option A is correct because the $MFT in NTFS maintains at least one file record for every file and directory stored on the volume, serving as the central index of all objects. Option B is correct because NTFS supports resident data, meaning small files (and small attributes) can be stored directly inside the $MFT file record rather than in separate clusters, which improves access efficiency. Option C is correct because each $MFT file record is normally 1024 bytes in size, a standard NTFS structure size that holds the record header and its attributes. Option D is incorrect because the $MFT is not guaranteed to sit at a fixed position at the start of the volume; its location is recorded in the boot sector, and it can be moved or fragmented. Option E is incorrect because the $MFT is not limited to directory metadata; it indexes all files and directories and stores their attributes and, when resident, their data.

Answer

It is located at a fixed position at the beginning of the volume

Answer

It is only used for directory metadata

Question 6

A forensic examiner is analyzing a RAID 5 array consisting of three disks. One disk has failed and is not available. The remaining two disks contain data and parity. Which technique can be used to reconstruct the missing disk's data and recover the original data?

Accepted Answer

Use dd to image the two disks, then perform a XOR operation on the data stripes to reconstruct the third disk's data. In a RAID 5 array with three disks, data and parity are striped across all disks. When one disk fails, the missing data can be reconstructed by performing an XOR operation on the corresponding stripes from the remaining two disks. This is because RAID 5 uses distributed parity where the parity block is the XOR of the data blocks in the same stripe, so XORing the surviving data and parity stripes recovers the lost data.

Answer

Replace the failed disk and rebuild the array using the controller's rebuild function

Answer

Use FTK Imager to create a logical image of each disk and merge them

Answer

Simply image the two disks and use file carving tools to extract files

Question 7

A forensic examiner is preparing to testify as an expert witness. Which THREE of the following qualities are essential for the examiner's testimony to be admissible under the Daubert standard? (Select THREE)

Accepted Answer

The methods used have been tested and are subject to peer review. Under Daubert v. Merrell Dow Pharmaceuticals, the trial judge acts as gatekeeper and assesses scientific testimony using several factors, three of which are reflected here. Option A is correct because Daubert explicitly considers whether the theory or technique can be (and has been) tested and whether it has been subjected to peer review and publication. Option B is correct because general acceptance in the relevant scientific or forensic community, though originally the Frye test, remains a Daubert factor the court may weigh. Option E is correct because Daubert requires consideration of the known or potential error rate of the methodology, along with the existence and maintenance of standards controlling its operation. Option C is not required, since Daubert focuses on the reliability of the methodology rather than a specific academic degree, and Option D is not required because prior testimony experience is not one of the Daubert reliability factors.

Answer

The examiner holds a degree in computer science

Answer

The examiner has testified in at least ten previous cases

Question 8

Which three of the following are common techniques used to hide data on a storage device? (Choose THREE.)

Accepted Answer

Host Protected Area (HPA). Host Protected Area (HPA) (B) is a hidden region of a hard disk defined by the ATA standard outside the addressable range reported to the OS, commonly used to conceal data from normal file access. Alternate Data Streams (ADS) in NTFS (C) allow additional data to be attached to a file without appearing in directory listings or standard file size, making them a classic hiding technique. Slack space (E), including file slack and volume slack, is leftover storage between the logical end of a file and the end of its allocated cluster or partition, and can be used to stash data invisible to normal file reads. File system journaling (A) is a reliability feature that logs metadata changes for crash recovery, not a concealment method, and the TRIM command (D) is an SSD maintenance operation that informs the drive which blocks are no longer in use, so neither hides data.

Answer

File system journaling

Answer

TRIM command

Question 9

Which THREE of the following are techniques used to hide data on a hard drive?

Accepted Answer

Host Protected Area (HPA). Host Protected Area (HPA) is correct because it is a hidden region of the disk, outside the normal addressable sectors reported to the OS, that can be used to conceal data from standard file system tools. Slack space is correct because the unused bytes between the logical end of a file and the end of its allocated cluster can store hidden data without changing the file's apparent size. Alternate Data Streams (ADS) is correct because NTFS allows multiple data streams to be attached to a single file, and these streams are not shown by ordinary directory listings, making them a common hiding technique. File carving is not a hiding technique but a forensic recovery method for reconstructing files from raw disk data, and hashing is an integrity-verification technique that produces a fixed-length digest and does not conceal data.

Answer

File carving

Answer

Hashing

Question 10

An analyst is conducting memory forensics on a Windows system using Volatility. Which THREE commands can provide information about network connections?

Accepted Answer

netscan. Option A, netscan, is correct because it scans for network artifacts such as TCP endpoints, listening sockets, and UDP connections across all memory pools, making it the modern Volatility plugin for network connection discovery. Option C, connscan, is correct because it scans physical memory for TCP connection objects (pool tag TcpE), revealing local and remote IP addresses and ports for established connections. Option D, sockets, is correct because it enumerates socket objects in memory, showing socket handles, protocols, and associated connection details. Option B, pstree, is not correct because it displays parent-child process relationships, not network connections. Option E, pslist, is not correct because it lists active processes from the process list, which contains no network connection information.

Answer

pstree

Answer

pslist

Question 11

Which TWO of the following are examples of file carving tools? (Select two.)

Accepted Answer

PhotoRec. PhotoRec (C) is a file-carving tool that recovers files by scanning raw disk or image data for known file signatures and reconstructing content without relying on filesystem metadata. Foremost (D) is likewise a signature-based carving utility originally developed for law enforcement that recovers files from disk images and unallocated space using header/footer patterns. WinPmem (A) is a memory acquisition tool, not a carving tool, so it does not belong. FTK Imager (B) is primarily a forensic imaging and preview tool rather than a file carver. dd (E) is a low-level bit-stream imaging/copying utility, not a carving tool.

Answer

WinPmem

Answer

FTK Imager

Answer

dd

Question 12

Which THREE of the following are characteristics of the GPT (GUID Partition Table) compared to MBR?

Accepted Answer

Partitions are identified by a Globally Unique Identifier (GUID). Option C is correct because GPT identifies each partition and partition type with a Globally Unique Identifier (GUID), which avoids the MBR's reliance on simple numeric type bytes and enables robust, unique identification. Option D is correct because GPT by default provides space for 128 primary partitions in its partition entry array, unlike MBR's four-primary-partition limit. Option E is correct because GPT writes a primary partition table near the beginning of the disk and a backup copy at the end of the disk, allowing recovery if the primary table is damaged. Option A is incorrect because GPT stores partition information in the GPT header and partition entry array, not in the boot code area; that description better fits MBR, where the partition table resides in the master boot record. Option B is incorrect because GPT uses 64-bit Logical Block Addressing (LBA), whereas MBR uses 32-bit LBA fields.

Answer

Partition information is stored in the boot code area

Answer

Uses a 32-bit Logical Block Address (LBA)

Question 13

Which TWO of the following tools are commonly used for file carving during forensic investigations?

Accepted Answer

Foremost. Foremost (C) is correct because it is a classic file-carving tool that scans raw disk images or unallocated space and reconstructs files by matching known headers, footers, and internal structures defined in its configuration file. PhotoRec (E) is also correct because it performs signature-based carving to recover deleted files from disk images, memory cards, and other media, ignoring the filesystem to extract data by content type. Sleuth Kit (A) is a forensic analysis toolkit for examining filesystem metadata and timelines rather than a dedicated carving tool, WinPmem (B) is a memory acquisition tool for capturing RAM images, and Volatility (D) is a memory forensics framework for analyzing RAM dumps, so none of these are primarily used for file carving.

Answer

Sleuth Kit

Answer

WinPmem

Answer

Volatility

Question 14

Which TWO of the following tools are primarily used for timeline analysis in digital forensics? (Select TWO.)

Accepted Answer

The Sleuth Kit (mactime). The Sleuth Kit's mactime tool (option B) is correct because it builds a bodyfile of MAC times (modified, accessed, changed, and created timestamps) from file system metadata and renders it into a chronological timeline, which is the core of timeline analysis in digital forensics. Plaso (option D) is also correct because it is a Python-based engine that parses many artifact types and, via its log2timeline/psort components, produces a super-timeline correlating events across sources, making it a primary timeline analysis tool. Autopsy (option C) is a full forensic platform that can display timelines, but it is not primarily a timeline analysis tool in the sense of the dedicated mactime and Plaso utilities. Nmap (option A) is a network discovery and port-scanning tool, and Wireshark (option E) is a packet capture and protocol analyzer; neither is designed for building forensic event timelines.

Answer

Nmap

Answer

Autopsy

Answer

Wireshark

Question 15

A security analyst is investigating a potential data breach in a GCP environment. The analyst reviews the GCP audit logs and finds the following events: (1) A service account was granted the 'roles/storage.objectAdmin' role on a storage bucket containing sensitive data, (2) The service account then listed objects in the bucket, (3) The service account downloaded several objects. Which THREE actions should the analyst take immediately?

Accepted Answer

Analyze the IAM policy change that granted the role to identify the source. Option A is correct because the first event is an IAM policy change (granting roles/storage.objectAdmin), and the analyst must trace the Admin Activity audit log entry for SetIamPolicy to identify the principal, source IP, user agent, and timestamp that made the grant. Option B is correct because roles/storage.objectAdmin grants full control over objects (create, read, update, delete), which is excessive for a service account that only needs to read sensitive data; revoking or downgrading the binding (e.g., to roles/storage.objectViewer) immediately limits further exfiltration. Option D is correct because audit logs are the primary forensic evidence and can be altered or aged out under the default 30-day Data Access log retention, so exporting them to a secure, immutable location (e.g., a locked Cloud Storage bucket or BigQuery dataset) preserves the chain of custody. Option C is not appropriate as an immediate technical step since law enforcement should be engaged only after internal incident response confirms a breach and per organizational/legal guidance. Option E is wrong because deleting the bucket destroys evidence and does not stop the already-granted service account from acting elsewhere; containment should be done via IAM revocation and key disabling instead.

Answer

Contact law enforcement immediately

Answer

Delete the storage bucket to prevent further access