CHFI Practice Test 48 — 15 Questions

Question 1

A security team is analyzing a compromised Linux server. Indicators suggest the attacker used a web shell. Which THREE of the following are common persistence mechanisms that may be found on the system? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Adding an SSH public key to /root/.ssh/authorized_keys. Option A is correct because appending an attacker-controlled public key to /root/.ssh/authorized_keys grants passwordless SSH access as root, a classic Linux persistence technique. Option B is correct because entries added to /etc/crontab (or /etc/cron.d, user crontabs) cause malicious commands or reverse shells to execute on a schedule, surviving reboots. Option E is correct because a malicious unit file placed in /etc/systemd/system/ and enabled with systemctl enable will start the attacker's payload automatically at boot. Option C is incorrect because NTUSER.DAT is a Windows registry hive and does not exist on Linux. Option D is incorrect because Prefetch files are a Windows artifact created by the OS for performance, not a Linux persistence mechanism.

Answer

Modification of the NTUSER.DAT registry hive

Answer

Prefetch file creation

Question 2

In a Mac forensic investigation, which TWO artifacts are valuable for determining the timeline of file access? (Select two.)

Accepted Answer

Unified logging. Unified logging (C) is correct because macOS's unified logging system (introduced in 10.12) stores system and application activity in .tracev3 files under /var/db/diagnostics, and its timestamps can establish when processes ran or files were touched, supporting timeline reconstruction. FSEvents (E) is correct because the FSEvents database (.fseventsd) records directory-level filesystem change events with timestamps, which is a core artifact for building a macOS file-access timeline. ShellBags (A) and NTUSER.DAT (D) are Windows artifacts (registry-based folder view settings and per-user registry hive, respectively) and do not exist on macOS. Prefetch files (B) are also a Windows artifact (C:\Windows\Prefetch) used for program execution analysis, not macOS file-access timelines.

Answer

ShellBags

Answer

Prefetch files

Answer

NTUSER.DAT

Question 3

Which TWO of the following are common Linux log files that can be used for forensic analysis?

Accepted Answer

/var/log/syslog. /var/log/syslog (B) is correct because it is the standard system log on many Linux distributions (Debian/Ubuntu and others), recording kernel messages, daemon activity, service events, and general system errors that are valuable for reconstructing a timeline during forensic analysis. /var/log/auth.log (C) is also correct because it captures authentication-related events such as logins, sudo usage, su attempts, and PAM/SSH authentication failures or successes, which are essential for investigating unauthorized access. The unmarked options do not belong: /etc/passwd (A) and /etc/shadow (D) are account database files, not log files, even though they are useful for reviewing user accounts and password hashes, and /proc/cpuinfo (E) is a virtual file exposing CPU details, not a log of system or security events.

Answer

/etc/passwd

Answer

/etc/shadow

Answer

/proc/cpuinfo

Question 4

Which THREE of the following are indicators of a webshell on a compromised web server? (Select THREE.)

Accepted Answer

Presence of system commands in web server error logs. Option B is correct because webshells typically execute operating-system commands (e.g., cmd.exe, /bin/sh, whoami, net user) that get recorded in web server error logs when the shell's input or output triggers errors, making such command strings a strong indicator of compromise. Option C is correct because attackers drop webshell files with executable web extensions such as .asp, .php, or .jsp into web-accessible directories (often with obfuscated or unusual names) so they can be invoked remotely over HTTP. Option D is correct because a webshell commonly initiates outbound connections from the web server to attacker-controlled command-and-control or exfiltration IP addresses, which is anomalous for a server that should mainly receive inbound HTTP requests. Option A is not specific to webshells, since multiple failed logins in auth.log indicate brute-force or credential attacks against SSH or other services rather than a web-based backdoor. Option E is also not specific, because high CPU usage from the web server process can result from legitimate traffic spikes, misconfiguration, or other malware, and is not a distinctive webshell indicator.

Answer

Multiple failed login attempts in auth.log

Answer

High CPU usage from the web server process

Question 5

Which TWO pieces of information can be obtained from an email's Received headers to help trace the email's origin? (Select TWO)

Accepted Answer

The IP address of the originating mail server. Option C is correct because Received headers record the connecting host's IP address (typically in the form 'Received: from mail.example.com ([192.0.2.1]) by ...'), which lets an investigator identify the originating mail server and trace the message's path back toward its source. Option E is correct because each Received header includes a date/time stamp showing when that hop processed the message, allowing analysts to reconstruct the chronological relay chain and spot delays or anomalies. The unmarked options do not belong: the DKIM signature hash (A) appears in the DKIM-Signature header, not Received; the sender's email client version (B) is not a standard Received field (it may appear in User-Agent or X-Mailer headers); and the subject line (D) is carried in the Subject header, which is unrelated to routing information.

Answer

The DKIM signature hash

Answer

The sender's email client version

Answer

The subject line of the email

Question 6

Which TWO of the following are typical sources of evidence for network forensics? (Select TWO.)

Accepted Answer

Firewall logs. Firewall logs (C) are a canonical network-forensics source because they record connection metadata such as source/destination IP addresses, ports, protocol, timestamps, and allow/deny actions, which lets an investigator reconstruct traffic flows and identify blocked or permitted communications. Packet capture (pcap) files (E) are also a core network-forensics source because they contain the actual captured frames/packets (e.g., from tcpdump/Wireshark), enabling deep protocol-level analysis of payloads, sessions, and anomalies. The other options are host-based artifacts rather than network evidence: Windows registry hives (A) store OS and application configuration, bash_history (B) records shell commands executed by a user, and Prefetch files (D) are Windows execution artifacts showing program run times and loaded modules.

Answer

Windows registry hives

Answer

bash_history

Answer

Prefetch files

Question 7

Which TWO of the following are common indicators of a path traversal attack found in web server logs? (Select 2)

Accepted Answer

Requests containing '../' sequences. Option B is correct because '../' is the canonical directory traversal sequence used to climb out of the web root and reference files outside the intended directory, so its appearance in request paths is a classic path traversal indicator. Option D is correct because '%2e%2e%2f' is the URL-encoded form of '../' (where %2e is '.', and %2f is '/'), and attackers frequently encode traversal sequences to bypass naive filters, making it an equally common log indicator. Option A is not a path traversal indicator; multiple or unusual User-Agent strings relate to client identification, bot activity, or user-agent spoofing, not directory traversal. Option C describes '<script>' tags, which indicate cross-site scripting (XSS) attempts rather than path traversal. Option E describes 'OR 1=1', a SQL injection tautology used to bypass authentication or manipulate queries, not a file-path traversal technique.

Answer

Requests containing a large number of User-Agent strings

Answer

Requests containing '<script>' tags

Answer

Requests containing 'OR 1=1'

Question 8

Which THREE of the following are Windows Event IDs that are particularly useful for investigating account logon activities?

Accepted Answer

4625 - An account failed to log on. Option A (4625 - An account failed to log on) is correct because it records failed authentication attempts in the Security log, which is essential for detecting brute-force, password-spraying, or unauthorized access attempts. Option B (4648 - A logon was attempted using explicit credentials) is correct because it captures scenarios where a process or user supplies alternate credentials (e.g., RunAs, scheduled tasks, or lateral movement with explicit creds), which is critical for tracing credential misuse. Option C (4624 - An account was successfully logged on) is correct because it documents successful logons, including logon type (2 interactive, 3 network, 10 RDP, etc.), enabling investigators to establish a timeline of legitimate or suspicious access. Option D (4656 - A handle to an object was requested) is not a logon event; it relates to object access auditing and handle requests, so it does not directly evidence account logon activity. Option E (7045 - A service was installed in the system) is a System log event about service installation (persistence), not an account logon event, so it is not relevant to investigating logon activities.

Answer

4656 - A handle to an object was requested

Answer

7045 - A service was installed in the system

Question 9

Which TWO of the following are forensic artifacts found on macOS systems that can help reconstruct user activity?

Accepted Answer

.plist files. Option A (.plist files) is correct because macOS stores application and system preferences, recent items, and user-activity metadata in property list files (often binary or XML) under ~/Library/Preferences and /Library/Preferences, which investigators can parse with plutil or plist editors to reconstruct user behavior. Option B (Unified logging) is correct because macOS's Unified Logging system (introduced in 10.12, accessed via the log command or log show) records detailed system, application, and user events in .tracev3 files under /var/db/diagnostics, providing a rich timeline of activity. Option C (Prefetch files) is incorrect because *.pf Prefetch files are a Windows artifact (C:\Windows\Prefetch) that does not exist on macOS. Option D (Registry hive files) is incorrect because the Windows Registry (e.g., NTUSER.DAT, SYSTEM, SAM) is not present on macOS, which uses plists and other stores instead. Option E (Event ID 4624) is incorrect because that is a Windows Security event log identifier for a successful logon, not a macOS forensic artifact.

Answer

Prefetch files (*.pf)

Answer

Registry hive files

Answer

Event ID 4624

Question 10

Which TWO of the following are indicators of a webshell attack found in web server logs? (Select TWO)

Accepted Answer

Requests to a .asp or .php file with parameters like cmd or exec. Option C is correct because webshells are typically small scripts (e.g., .asp, .php, .jsp) that accept command parameters such as cmd, exec, or shell, so log entries showing requests to such files with those parameter names are a strong indicator of command execution through a webshell. Option E is correct because attackers commonly upload a webshell into a writable upload directory and then interact with it via POST requests, so repeated POSTs to a script in an upload folder in the web logs is a classic webshell traffic pattern. Option A is not specific to webshells, since OPTIONS and TRACE are legitimate HTTP methods and their presence alone does not indicate a webshell. Option B is too generic, as high traffic from one IP can result from many benign causes such as crawlers, load balancers, or DoS activity. Option D is also non-specific, because frequent 404 errors usually indicate broken links, scanning, or enumeration rather than webshell command execution.

Answer

Abnormal HTTP methods like OPTIONS or TRACE

Answer

High volume of traffic from a single IP

Answer

Frequent 404 errors for non-existent pages

Question 11

During a Linux forensic investigation, an analyst examines the file /var/log/auth.log and finds repeated entries with 'Failed password for root from 192.168.1.200 port 22 ssh2'. Which TWO conclusions can the analyst draw from this evidence?

Accepted Answer

The system is experiencing a brute-force attack on SSH. Option B is correct because repeated 'Failed password for root' entries in /var/log/auth.log indicate multiple unsuccessful SSH authentication attempts against the root account, which is the classic signature of an SSH brute-force attack. Option C is correct because the log entries show connections to port 22 with the ssh2 protocol, meaning the SSH daemon (sshd) is running and accepting connections on TCP port 22. Option A is not supported: 192.168.1.200 is a private RFC 1918 address, but that alone does not prove it is on the same local subnet as the examined host. Option D is wrong because failed password entries reflect authentication failures, not exploitation of an SSH software vulnerability. Option E is wrong because 'Failed password' explicitly indicates the login attempts did not succeed.

Answer

The source IP 192.168.1.200 belongs to a local subnet

Answer

The attacker attempted to exploit a vulnerability in the SSH version

Answer

An unauthorized user successfully logged in as root

Question 12

During a forensic investigation of a Windows 10 system, you need to analyze the file system to recover deleted files. Which TWO file system artifacts would be most useful for this purpose?

Accepted Answer

$LogFile. The $MFT (Master File Table) is correct because it is the core NTFS metadata structure that contains a record for every file and directory, including entries for deleted files whose records may still hold the filename, timestamps, size, and data run locations needed for recovery. The $LogFile is correct because it is NTFS's transaction journal, which records metadata changes such as file creation, deletion, and renaming, allowing investigators to reconstruct prior states and corroborate evidence of deleted files. The $Boot file is not the best choice because it primarily stores volume boot code and basic geometry/BPB parameters, not per-file records. The $Volume file holds volume label and version information, which is not useful for recovering deleted files. The $Bitmap tracks cluster allocation (which clusters are in use versus free) and can help locate unallocated space, but by itself it does not preserve deleted file metadata or names the way the $MFT and $LogFile do.

Answer

$Boot file

Answer

$Volume

Answer

$Bitmap

Question 13

A GCP audit log shows a project owner granted 'iam.serviceAccountUser' role to a service account from a different project. Which TWO potential security implications should the investigator prioritize?

Accepted Answer

The service account can be used to escalate privileges by attaching it to resources. Option A is correct because the iam.serviceAccountUser role grants the ability to attach a service account to a resource (for example, deploying a Compute Engine instance or Cloud Function that runs as that service account), which can let a principal act with the service account's permissions and escalate privileges. Option D is correct because granting this role to a service account from a different project creates a cross-project trust path, enabling lateral movement from the attacker's project into the target project's resources. Option B is wrong because granting iam.serviceAccountUser does not disable or modify audit logging. Option C is wrong because key rotation is not triggered by this role grant and is unrelated to it. Option E is wrong because iam.serviceAccountUser does not grant user impersonation; that requires roles/iam.serviceAccountTokenCreator or the iam.serviceAccounts.getAccessToken permission.

Answer

The audit logging is now disabled for that service account

Answer

The service account's keys are automatically rotated

Answer

The service account can now impersonate any user in the project

Question 14

A security analyst detects that a known malware sample writes to the registry key 'HKLM\SYSTEM\CurrentControlSet\Services\<malware>\ImagePath' and creates a service. This behavior is characteristic of which type of persistence mechanism?

Accepted Answer

Windows service. The malware writes to 'HKLM\SYSTEM\CurrentControlSet\Services\<malware>\ImagePath' and creates a service, which is the exact mechanism for registering a Windows service. This persistence method ensures the malware runs automatically when the system boots, as the Service Control Manager (SCM) loads services based on this registry key. Option D is correct because this behavior directly corresponds to the Windows service persistence technique.

Answer

Scheduled task

Answer

AppInit_DLLs

Answer

Startup folder entry

Question 15

In an AWS environment, a security analyst detects unusual API calls that created several IAM users with administrative privileges from an unfamiliar IP address. Which AWS service log should be examined first to identify the specific API calls and the IAM user that made them?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including the identity of the caller (IAM user or role), the source IP address, and the specific API actions (e.g., CreateUser, AttachUserPolicy). In this scenario, CloudTrail logs will directly show which IAM user made the unusual API calls from the unfamiliar IP address, enabling the analyst to trace the unauthorized activity.

Answer

Amazon S3 access logs

Answer

AWS CloudWatch Logs

Answer

AWS Config