CHFI Practice Test 49 — 15 Questions

Question 1

During a Windows forensic investigation, an analyst finds prefetch files with the .pf extension. Which TWO pieces of information can the analyst obtain from analyzing prefetch files?

Accepted Answer

The number of times the application has been executed. Prefetch files (.pf) in Windows record execution metadata for applications, and option A is correct because each prefetch file stores an execution count showing how many times the application has been run. Option B is also correct because prefetch files contain timestamps, including the last execution time and, in many versions, up to eight previous execution times, allowing an analyst to determine when the application was executed. These timestamps are stored in the prefetch file's metadata and are a core reason prefetch analysis is valuable in forensics. Option C is not correct because prefetch files do not record the username that executed the application; that information is typically found in other artifacts such as Security event logs or UserAssist. Option D is not correct because command-line arguments are not stored in prefetch files; they are more commonly recovered from process execution artifacts like ShimCache, AmCache, or event logs. Option E is not correct because prefetch files do not contain network connection data such as IP addresses; those would be found in network artifacts or logs.

Answer

The username that executed the application

Answer

The command-line arguments used to launch the program

Answer

The IP addresses the application connected to

Question 2

Which of the following is a key difference between static analysis and dynamic analysis in malware forensics?

Accepted Answer

Static analyzes the code without execution; dynamic executes the malware.. Static analysis involves examining the malware's code (e.g., disassembly, string extraction, hash analysis) without executing it, while dynamic analysis runs the malware in a controlled sandbox environment to observe its runtime behavior, such as file system changes, registry modifications, and network connections. This fundamental distinction is critical in malware forensics to safely understand the threat without risking infection.

Answer

Static analysis requires the malware to be executed, while dynamic analysis does not.

Answer

Static analysis is used only for packed malware, while dynamic analysis is used for unpacked.

Answer

Dynamic analysis uses tools like IDA Pro, while static uses Cuckoo Sandbox.

Question 3

A malware analyst runs a suspicious executable in Cuckoo Sandbox. The report shows that the process created a mutex named 'Global\MyMalwareMutex'. What is the significance of this mutex?

Accepted Answer

It prevents multiple instances of the malware from running simultaneously. The mutex named 'Global\MyMalwareMutex' is a named synchronization object used by the malware to ensure only one instance of its process runs at a time. This prevents conflicts in operations like file writing or network communication that could occur if multiple copies executed simultaneously. In Cuckoo Sandbox, detecting such a mutex is a common indicator of single-instance malware behavior.

Answer

It is used to communicate with a remote command and control server

Answer

It indicates the malware is packed with UPX

Answer

It stores encrypted configuration data

Question 4

In Linux, which file contains hashed user passwords?

Accepted Answer

/etc/shadow. The /etc/shadow file stores hashed user passwords along with password aging information, and is readable only by root to enhance security. In contrast, /etc/passwd contains user account information but stores only a placeholder (usually 'x' or '*') for the password hash, not the hash itself. This separation is a standard Linux security mechanism to prevent unauthorized access to password hashes.

Answer

/etc/gshadow

Answer

/etc/group

Answer

/etc/passwd

Question 5

A security analyst is reviewing output from a Cuckoo Sandbox analysis of a suspicious executable. The report shows that the process created a mutex named 'Global\GLOBAL_MUTEX_123' and modified the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\. Which behavioral indicator is MOST evident?

Accepted Answer

Persistence mechanism. The modification of the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism. This key is automatically processed by Windows Explorer at user logon, causing any executable listed there to run. Combined with the mutex creation (which prevents multiple instances), the behavioral indicator is clearly an attempt to establish persistence on the host.

Answer

Command and control communication

Answer

Anti-debugging technique

Answer

Privilege escalation

Question 6

An analyst runs 'regshot' before and after executing a suspicious binary. The report shows that the binary added a value to HKLM\SYSTEM\CurrentControlSet\Services\MyService with 'ImagePath' pointing to C:\Windows\system32\malware.exe and 'Start' set to 2. What is the MOST likely purpose?

Accepted Answer

Persistence as a service. The binary added a service entry under HKLM\SYSTEM\CurrentControlSet\Services\MyService with 'ImagePath' pointing to malware.exe and 'Start' set to 2 (SERVICE_AUTO_START). This ensures the malware launches automatically at system boot, which is a classic persistence mechanism. The 'Start' value of 2 specifically configures the service to start automatically, making it persist across reboots.

Answer

Hiding network connections

Answer

Encrypting files

Answer

Disabling a legitimate service

Question 7

Which of the following is the primary purpose of performing static analysis on a suspicious binary?

Accepted Answer

Analysing the binary's code and structure without executing it. Static analysis examines a binary's code and structure without executing it, allowing analysts to identify malicious indicators such as embedded strings, import tables, and cryptographic constants. This approach avoids triggering anti-analysis mechanisms that activate upon execution, making it a foundational step in malware forensics.

Answer

Capturing network traffic generated by the binary

Answer

Observing the binary's runtime behaviour in a sandbox

Answer

Modifying the binary to bypass anti-analysis techniques

Question 8

A forensic analyst is examining a FAT32 file system and finds that the file allocation table indicates a cluster chain ending with 0x0FFFFFFF. What does this value signify?

Accepted Answer

End-of-file marker. In FAT32 file systems, the File Allocation Table (FAT) uses 32-bit entries to track cluster allocation. The value 0x0FFFFFFF is the defined end-of-file (EOF) marker, indicating that the current cluster is the last in a file's cluster chain. This is a standard FAT32 convention, distinct from other special values like free or bad clusters.

Answer

Free cluster

Answer

Reserved cluster

Answer

Bad cluster

Question 9

In iOS forensics, which database file typically contains the call history, including incoming, outgoing, and missed calls?

Accepted Answer

call_history.db. In iOS forensics, the call history (incoming, outgoing, and missed calls) is stored in the SQLite database file named `call_history.db`. This database is located within the root domain of the iOS file system (typically under `/private/var/mobile/Library/CallHistoryDB/`) and contains tables such as `call` and `call_history` that record each call's direction, duration, timestamp, and associated contact identifier. The CHFI exam specifically tests this file as the authoritative source for call log evidence.

Answer

Notes.db

Answer

AddressBook.db

Answer

SMS.db

Question 10

A security analyst observes a process on a Windows system creating a mutex named "Global\{5B9E4E7E-8B2C-4F6D-A1A3-F2C8D9E0A1B2}" shortly after execution. The analyst also notes outbound connections to an IP address 203.0.113.50 on port 4444. Which malware behaviour indicator is MOST clearly demonstrated?

Accepted Answer

Single-instance execution safeguard and command and control communication. The mutex name 'Global\{5B9E4E7E-8B2C-4F6D-A1A3-F2C8D9E0A1B2}' is a well-known technique used by malware to ensure only one instance of itself runs on the system, preventing conflicts or multiple infections. The outbound connection to 203.0.113.50 on TCP port 4444 is a classic indicator of command and control (C2) communication, as port 4444 is commonly associated with reverse shells and C2 traffic (e.g., Metasploit default). Together, these two behaviors directly demonstrate single-instance execution safeguard and C2 communication.

Answer

Anti-debugging technique through timing checks

Answer

File encryption using a hardcoded AES key

Answer

Persistence mechanism via registry run keys

Question 11

An investigator extracts the SMS.db file from an iOS backup. Which table within this database would contain the actual message content for sent and received messages?

Accepted Answer

message. The `message` table in iOS's SMS.db database stores the actual text content of each SMS and iMessage in its `text` column. This is the primary table queried to retrieve the body of sent and received messages, as it contains one row per message with fields like `is_from_me`, `date`, and `text`.

Answer

attachment

Answer

handle

Answer

chat

Question 12

During dynamic analysis of a Windows malware sample, Process Monitor shows repeated writes to 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'. What does this behaviour indicate?

Accepted Answer

The malware is establishing persistence to run at system startup. The registry key 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' is a standard Windows autorun location. Malware writing to this key ensures that its executable is launched automatically every time the system boots, which is a classic persistence mechanism. Process Monitor capturing repeated writes confirms the malware is actively establishing this startup persistence.

Answer

The malware is disabling Windows Defender

Answer

The malware is modifying network configuration

Answer

The malware is performing log wiping

Question 13

During a forensic investigation of an Android device, the examiner uses ADB to extract data. Which command would create a full backup of the device's data partition, including app data and shared storage?

Accepted Answer

adb backup -f backup.ab -apk -shared -all. The `adb backup -f backup.ab -apk -shared -all` command creates a full Android backup that includes all apps and their data (via `-all`), includes APK files (via `-apk`), and includes shared storage (via `-shared`), outputting a single `.ab` file. This is the standard ADB method for non-rooted devices to capture a comprehensive logical backup of app data and shared storage.

Answer

adb shell dd if=/dev/block/mmcblk0 of=/data/backup.img

Answer

adb pull /data/data/

Answer

adb restore backup.ab

Question 14

Which Android file system location is MOST likely to contain user-installed app data, preferences, and cached information?

Accepted Answer

/data/data/. The /data/data/ directory on Android devices stores application-specific data for user-installed apps, including preferences (shared preferences XML files), databases, and cached information. This location is part of the internal storage partition and is sandboxed per app, ensuring that each app can only access its own data directory. It is the primary repository for runtime app data, making it the most relevant for forensic analysis of user-installed app artifacts.

Answer

/vendor/

Answer

/system/

Answer

/mnt/sdcard/

Question 15

An analyst suspects a Windows executable is packed. They run `strings` on the file and see few readable strings, and PEiD reports 'UPX 0.89.6 - 1.02 / 1.05 - 1.24'. Which static analysis technique should the analyst use NEXT to extract the original code?

Accepted Answer

Use UPX with the -d flag to decompress the executable. UPX (Ultimate Packer for Executables) is a common packer that compresses Windows executables. The PEiD output 'UPX 0.89.6 - 1.02 / 1.05 - 1.24' confirms the file is packed with UPX. Running `upx -d` (decompress) reverses the packing, restoring the original executable code for static analysis. This is the standard next step before attempting disassembly or dynamic analysis.

Answer

Search for known YARA rules matching UPX

Answer

Run the executable in Cuckoo Sandbox to obtain dynamic analysis

Answer

Load the file into IDA Pro and attempt to disassemble directly