CHFI Practice Test 46 — 15 Questions

Question 1

A security analyst reviews the following Apache access log entry: 192.168.1.10 - - [15/May/2025:10:15:23 +0000] "GET /search.php?q=1'%20OR%20'1'='1 HTTP/1.1" 200 5321 "-" "Mozilla/5.0". Which type of attack is most likely indicated?

Accepted Answer

SQL injection (SQLi). The log shows a GET request with a SQL injection payload (1' OR '1'='1) in the 'q' parameter. The HTTP 200 response indicates the server processed the request, suggesting a successful or attempted SQL injection.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Remote file inclusion

Question 2

A GCP audit log shows a project owner granted 'iam.serviceAccountUser' role to a service account from a different project. Which TWO potential security implications should the investigator prioritize?

Accepted Answer

The service account can be used to escalate privileges by attaching it to resources. This privilege escalation allows the service account to impersonate other accounts and potentially access resources across projects.

Answer

The audit logging is now disabled for that service account

Answer

The service account's keys are automatically rotated

Answer

The service account can now impersonate any user in the project

Question 3

In Mac forensics, which artifact stores system-wide and per-user application preferences, often used to determine configured settings and recently accessed files?

Accepted Answer

.plist files. .plist files (property lists) are used on macOS to store application preferences and configuration data. They can be analyzed to extract user activity and settings.

Answer

Unified logging

Answer

Sqlite databases

Answer

FSEvents

Question 4

An investigator is analyzing a Windows 10 system suspected of malware persistence. Which registry key is commonly used by malware to achieve persistence by running a program at every user logon?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The Run key under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run is a common persistence mechanism that starts programs when the user logs on.

Answer

HKLM\SAM\SAM

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall

Question 5

During a Windows forensic investigation, an analyst finds prefetch files with the .pf extension. Which TWO pieces of information can the analyst obtain from analyzing prefetch files?

Accepted Answer

The number of times the application has been executed. Prefetch files contain metadata about application execution including the full path to the executable, run count, and last run time. They can also list DLLs loaded. The run count and last run time are useful for forensic timeline.

Answer

The username that executed the application

Answer

The command-line arguments used to launch the program

Answer

The IP addresses the application connected to

Question 6

An organization uses Azure. A security analyst needs to investigate a suspicious login event. Which Azure log contains details about user sign-ins, including IP address, timestamp, and success/failure status?

Accepted Answer

Azure AD Sign-in logs. Azure Activity Logs (now also called Azure Monitor activity log) record subscription-level events, but user sign-in details are specifically in Azure AD Sign-in logs, which are part of Azure Active Directory reporting. However, the question asks about Azure logs; the most appropriate is Azure AD Sign-in logs, but since that's not an option, the closest is Azure Activity Logs which can capture management events, but not sign-ins. Actually, Azure AD Sign-in logs are the correct source. But given options, if only Azure Activity Logs is present, it's partially correct. The typical answer is Azure AD Sign-in logs. Since the question says "Azure log", the best choice is Azure Activity Logs as it's within Azure Monitor, but it's not precise. Let's adjust options accordingly. I'll assume Azure AD Sign-in logs is not listed; I'll create a plausible distractor. Actually, in real exam, they expect Azure AD Sign-in logs. I'll make sure one option says "Azure AD Sign-in logs". But the stem says "Azure log", so I'll include it. Let me redo: The correct answer should be Azure AD Sign-in logs. I'll set that as option A.

Answer

Azure Monitor Metrics

Answer

Azure Activity Logs

Answer

Azure Security Center alerts

Question 7

During a forensic investigation of a compromised web server, an analyst examines the Apache access log and finds the following entry: '192.168.1.10 - - [12/Oct/2024:13:45:22 +0000] "GET /index.php?id=1 UNION SELECT username, password FROM users-- HTTP/1.1" 200 1234 "-" "Mozilla/5.0"'. What type of attack is MOST likely indicated?

Accepted Answer

SQL injection (SQLi). The log entry contains 'UNION SELECT username, password FROM users--', which is a SQL injection attempt to retrieve data from the users table.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Remote file inclusion (RFI)

Question 8

An email forensic analyst receives a suspicious email and wants to verify the originating IP address. The analyst extracts the email headers and sees multiple 'Received' fields. Which 'Received' header should the analyst consider as the most trustworthy source of the sender's IP?

Accepted Answer

The last 'Received' header at the bottom. The lowest (last) 'Received' header in the email is the first hop from the sender's MTA, making it the most trustworthy for the originating IP.

Answer

The first 'Received' header at the top

Answer

The 'X-Originating-IP' header

Answer

The 'Return-Path' header

Question 9

During an investigation of a web application breach, an analyst reviews IIS logs and finds numerous entries with status code '200' and URIs containing '?cmd=' followed by encoded strings. The analyst also notices that some requests have a 'User-Agent' string resembling 'Microsoft-CryptoAPI/10.0'. What is the MOST likely conclusion?

Accepted Answer

A webshell is being used to execute commands on the server. A valid POST request with no cookies and a suspicious User-Agent could indicate a webshell attempting to exfiltrate data or execute commands, as the User-Agent is atypical for a browser.

Answer

The logs indicate a successful SQL injection attack

Answer

The logs show a cross-site scripting (XSS) attack targeting administrators

Answer

The server is infected with ransomware, encrypting files

Question 10

Which email header field is specifically used to verify that an email was not tampered with during transit and is signed by the sender's domain?

Accepted Answer

DKIM-Signature. DKIM-Signature header contains a digital signature that allows the receiver to verify the email's integrity and authenticity.

Answer

X-Originating-IP

Answer

Message-ID

Answer

Received

Question 11

An incident responder is analyzing a compromised web server and finds a file named 'cmd.aspx' in the uploads directory. The file contains ASP.NET code that accepts commands via the 'cmd' parameter and executes them on the server. Which of the following best describes this artifact?

Accepted Answer

A webshell allowing remote command execution. A web shell is a script uploaded to a web server that allows remote command execution. The filename and behavior match a webshell.

Answer

A legitimate administrative tool for server management

Answer

A backdoor installed via a SQL injection vulnerability

Answer

A malware dropper for deploying ransomware

Question 12

Which TWO tools are commonly used for email forensic analysis and metadata extraction?

Accepted Answer

Aid4Mail. Aid4Mail and EmailTracker are specialized for email forensics.

Answer

Wireshark

Answer

Volatility

Answer

FTK Imager

Question 13

A network forensic analyst captures traffic that includes the following Wireshark filter: "tcp.port == 22 and tcp.flags.syn == 1 and tcp.flags.ack == 0". What type of traffic is this filter selecting?

Accepted Answer

Outgoing SSH connection attempts. The filter matches TCP packets to port 22 (SSH) with only the SYN flag set (SYN=1, ACK=0). These are the first packets in a TCP handshake, representing connection attempts.

Answer

SSH traffic with payload

Answer

SSH key exchange

Answer

SSH established sessions

Question 14

Which Linux log file is the primary source for authentication-related events, including SSH login attempts and sudo usage?

Accepted Answer

/var/log/auth.log. On most Linux distributions, authentication events are logged to /var/log/auth.log (or /var/log/secure on RHEL-based systems).

Answer

/var/log/kern.log

Answer

/var/log/syslog

Answer

/var/log/messages

Question 15

A forensic analyst is investigating a Windows system and wants to identify recently executed programs. Which TWO artifacts should the analyst examine?

Accepted Answer

Prefetch files. Prefetch files and UserAssist registry keys are both used to track program execution. Prefetch stores execution count and timestamps; UserAssist logs programs launched from the Start Menu or desktop.

Answer

MRU lists

Answer

ShellBags

Answer

Jump lists