CHFI Practice Exam 61 — 20 Questions

Question 1

A malware analyst uses Cuckoo Sandbox to analyze a sample. The report shows that the sample sends HTTP POST requests to 'http://malicious.example.com/gate.php' with encrypted data. Which type of indicator of compromise (IoC) is this?

Accepted Answer

Network-based IoC. The HTTP POST request to a remote URL with encrypted data is a classic network-based indicator because it involves communication over a network protocol (HTTP) to an external server. Cuckoo Sandbox captures this as a network artifact, making it a network-based IoC (Option D). Host-based IoCs focus on file system or registry changes, memory-based on in-RAM artifacts, and hash-based on file fingerprints.

Answer

Host-based IoC

Answer

Memory-based IoC

Answer

Hash-based IoC

Question 2

An analyst runs 'regshot' before and after executing a suspicious binary. The report shows that the binary added a value to HKLM\SYSTEM\CurrentControlSet\Services\MyService with 'ImagePath' pointing to C:\Windows\system32\malware.exe and 'Start' set to 2. What is the MOST likely purpose?

Accepted Answer

Persistence as a service. The binary added a service entry under HKLM\SYSTEM\CurrentControlSet\Services\MyService with 'ImagePath' pointing to malware.exe and 'Start' set to 2 (SERVICE_AUTO_START). This ensures the malware launches automatically at system boot, which is a classic persistence mechanism. The 'Start' value of 2 specifically configures the service to start automatically, making it persist across reboots.

Answer

Hiding network connections

Answer

Encrypting files

Answer

Disabling a legitimate service

Question 3

In an Android forensic investigation, an examiner extracts the /data/data/com.whatsapp/databases/msgstore.db file. The database contains a table 'messages' with columns 'key_remote_jid', 'data', and 'timestamp'. Which SQL query would retrieve all messages sent to a specific contact with a phone number ending in '1234'?

Accepted Answer

SELECT * FROM messages WHERE key_remote_jid LIKE '%1234%'. Option B is correct because the `key_remote_jid` column stores the remote party's identifier (e.g., a phone number with country code), and the `LIKE '%1234%'` pattern matches any value containing '1234' anywhere in the string. This retrieves all messages where the contact's phone number ends with '1234', as required by the question.

Answer

SELECT * FROM messages WHERE key_remote_jid = '%1234%'

Answer

SELECT * FROM messages WHERE data LIKE '%1234%'

Answer

SELECT * FROM messages WHERE timestamp LIKE '%1234%'

Question 4

A forensic analyst is examining an Android device that was factory reset before seizure. Which Google account artefacts are MOST likely still recoverable from the device's storage?

Accepted Answer

Google account authentication tokens and cached account data. Factory reset on Android typically wipes user data partitions (e.g., /data) but does not securely overwrite the entire flash storage. Google account authentication tokens (e.g., OAuth 2.0 tokens) and cached account data (e.g., account names, sync settings) are often stored in system-level databases or encrypted key stores that may persist in unallocated or residual flash blocks, especially if TRIM or secure erase was not executed. These artefacts can be recovered via forensic imaging and carving of the raw NAND or eMMC.

Answer

All installed application APK files

Answer

Full SMS message history

Answer

Encryption keys for user data partition

Question 5

A malware analyst runs a suspicious executable in Cuckoo Sandbox. The report shows that the process created a mutex named 'Global\MyMalwareMutex'. What is the significance of this mutex?

Accepted Answer

It prevents multiple instances of the malware from running simultaneously. The mutex named 'Global\MyMalwareMutex' is a named synchronization object used by the malware to ensure only one instance of its process runs at a time. This prevents conflicts in operations like file writing or network communication that could occur if multiple copies executed simultaneously. In Cuckoo Sandbox, detecting such a mutex is a common indicator of single-instance malware behavior.

Answer

It is used to communicate with a remote command and control server

Answer

It indicates the malware is packed with UPX

Answer

It stores encrypted configuration data

Question 6

Which of the following tools is BEST suited for performing static analysis of a malware binary to identify strings, headers, and imported functions without executing the file?

Accepted Answer

IDA Pro. IDA Pro is the correct choice because it is a disassembler and debugger specifically designed for static analysis of binary executables. It allows an analyst to examine strings, PE/ELF headers, and imported functions without executing the file, making it ideal for malware reverse engineering. In contrast, the other options require execution or focus on runtime behavior.

Answer

Cuckoo Sandbox

Answer

Any.run

Answer

Process Monitor

Question 7

During an iOS forensic examination of an iCloud backup, an analyst finds that the SQLite database files for the Health app are encrypted. Which component is MOST likely responsible for encrypting this data, and what is required to decrypt it?

Accepted Answer

The data is protected by iOS Data Protection using a key derived from the device passcode; decryption requires the passcode or a forensic bypass tool.. Option D is correct because iOS Health app data is protected by iOS Data Protection, which uses a class key derived from the user's device passcode. This key encrypts the SQLite database files in iCloud backups, and decryption requires either the passcode or a forensic bypass tool that can extract the key from the device's Secure Enclave.

Answer

The data is encrypted with the device's hardware UID; decryption is impossible without Apple's assistance.

Answer

The data is encrypted using Apple's FileVault; decryption requires the user's iCloud password.

Answer

The data is encrypted using SQLCipher; decryption requires a 256-bit key stored in the Keychain.

Question 8

A forensic examiner is analyzing an Android device that has been factory reset. Which artefact is MOST likely to persist after a factory reset, providing potential evidence of prior usage?

Accepted Answer

Google account artefacts. Google account artefacts, such as the Google Services Framework (GSF) ID and the device's Google Account (GAIA) ID, are stored in the /data/system/ partition and are often retained even after a factory reset because the reset does not always wipe the cryptographic keys or the persistent data blocks used by Google's sync services. This allows forensic tools to recover the previously synced account details, providing evidence of prior usage.

Answer

App installation logs

Answer

Deleted SMS messages

Answer

Wi-Fi passwords

Question 9

A forensic examiner is analyzing an Android device and wants to extract the database containing the user's text messages (SMS). In which directory would the examiner typically find the SMS database on a non-rooted device?

Accepted Answer

/data/data/com.android.providers.telephony/databases/. The SMS database on Android devices is stored by the telephony provider, which manages SMS/MMS messages. On non-rooted devices, the database is located at /data/data/com.android.providers.telephony/databases/mmssms.db, as the package com.android.providers.telephony is the system application responsible for handling SMS and MMS operations.

Answer

/data/data/com.android.providers.contacts/databases/

Answer

/data/data/com.android.providers.calendar/databases/

Answer

/data/data/com.android.providers.downloads/databases/

Question 10

A security analyst detects that a system's 'SeDebugPrivilege' is enabled for a suspicious process. Which technique is the malware MOST likely attempting to use?

Accepted Answer

Process injection. SeDebugPrivilege allows a process to debug other processes, including accessing and modifying their memory. Malware often enables this privilege to perform process injection, where malicious code is written into the memory of a legitimate process (e.g., via WriteProcessMemory and CreateRemoteThread) to evade detection and execute under the target process's context.

Answer

Persistence through service

Answer

Anti-debugging

Answer

Network sniffing

Question 11

A malware analyst is performing dynamic analysis of a trojan. Which THREE of the following tools are commonly used to monitor system changes during execution?

Accepted Answer

Process Monitor. Process Monitor (A) is correct because it is a real-time system monitoring tool that captures file system, registry, and process/thread activity, allowing analysts to observe changes made by a trojan during execution. It uses kernel-mode drivers to log operations such as CreateFile, RegSetValue, and CreateProcess, which are essential for dynamic analysis.

Answer

Ghidra

Answer

PEiD

Question 12

In iOS forensics, which database file typically contains the call history, including incoming, outgoing, and missed calls?

Accepted Answer

call_history.db. In iOS forensics, the call history (incoming, outgoing, and missed calls) is stored in the SQLite database file named `call_history.db`. This database is located within the root domain of the iOS file system (typically under `/private/var/mobile/Library/CallHistoryDB/`) and contains tables such as `call` and `call_history` that record each call's direction, duration, timestamp, and associated contact identifier. The CHFI exam specifically tests this file as the authoritative source for call log evidence.

Answer

Notes.db

Answer

AddressBook.db

Answer

SMS.db

Question 13

A forensic analyst is examining an iOS backup taken from a suspect's iPhone using iTunes. Which of the following SQLite databases would contain the suspect's call history?

Accepted Answer

call_history.db. The call history on an iOS device is stored in a SQLite database named `call_history.db` (or `call_history.db` within the root domain of the user's backup). When an iTunes backup is created, this database is included in the backup manifest and can be extracted and queried to retrieve call logs, including timestamps, durations, and phone numbers. Option B is correct because it is the specific database that contains call history records.

Answer

AddressBook.db

Answer

Calendar.sqlitedb

Answer

SMS.db

Question 14

A forensic examiner is analyzing a mobile device that may have been tampered with to erase evidence. Which TWO anti-forensic techniques are commonly encountered in mobile forensics? (Select TWO.)

Accepted Answer

Factory reset. Factory reset (option C) is a common anti-forensic technique in mobile forensics because it wipes user data partitions and resets the device to its original state, often using the 'wipe_data' command in recovery mode or via settings. This removes user-installed applications, accounts, and files, making data recovery difficult unless a physical or chip-off method is used. Timestomping (option E) is also common, as attackers modify file timestamps (e.g., using 'touch -t' on rooted devices or manipulating EXT4 metadata) to mislead forensic timelines and hide the sequence of events.

Answer

Encryption

Answer

Steganography

Answer

Log wiping

Question 15

During a forensic investigation of a Windows system infected with ransomware, the analyst discovers that the malware deleted volume shadow copies using vssadmin.exe. Which anti-forensic technique does this represent, and what is its primary purpose?

Accepted Answer

Log wiping; to remove forensic evidence of file changes and prevent data recovery. Option B is correct because deleting Volume Shadow Copies using vssadmin.exe is a classic example of log wiping (anti-forensic technique). The primary purpose is to remove forensic evidence of file changes and prevent data recovery, as shadow copies contain previous versions of files that could be used to restore encrypted data or track the ransomware's activity.

Answer

Encryption; to encrypt the shadow copies to prevent analysis

Answer

Timestomping; to alter timestamps of the shadow copy files

Answer

Data hiding; to conceal the malware's files within shadow copies

Question 16

Which THREE of the following are common techniques used by malware to achieve persistence on a Windows system? (Select THREE)

Accepted Answer

Creating a scheduled task. Creating a scheduled task is a common persistence technique because it allows malware to execute at predefined times or system events, such as user logon or system startup. The Windows Task Scheduler can run arbitrary executables with SYSTEM privileges, making it a reliable method for maintaining access even after a reboot.

Answer

Process hollowing

Answer

WMI event subscription

Question 17

Which of the following tools is designed specifically for dynamic analysis of malware by executing it in a controlled, isolated environment?

Accepted Answer

Cuckoo Sandbox. Cuckoo Sandbox is an open-source automated malware analysis system designed specifically for dynamic analysis. It executes suspicious files in a controlled, isolated environment (a virtual machine) and monitors their behavior, including system calls, file system changes, registry modifications, and network traffic, to produce a comprehensive report without risking the host system.

Answer

PEiD

Answer

Ghidra

Answer

IDA Pro

Question 18

During a mobile forensic investigation of an iPhone, an examiner needs to recover deleted SMS messages. Which acquisition method provides the highest likelihood of retrieving deleted data from the device's flash memory?

Accepted Answer

Physical acquisition via JTAG or chip-off. Physical acquisition via JTAG or chip-off provides the highest likelihood of recovering deleted SMS messages because it accesses the raw NAND flash memory at the hardware level, bypassing the iOS file system and logical abstractions. Deleted data on flash storage remains in unallocated blocks until overwritten, and physical imaging captures these remnants, including deleted SQLite records from the SMS database. In contrast, logical and file system methods only retrieve active files, missing the unallocated space where deleted messages reside.

Answer

Manual acquisition by taking screenshots

Answer

File system acquisition via iOS file system extraction

Answer

Logical acquisition via iTunes backup

Question 19

Which TWO of the following are essential components of chain of custody documentation?

Accepted Answer

Every person who handled the evidence must sign and date the form. Option A is correct because chain of custody documentation must record every individual who handled the evidence, along with their signature and the date/time of transfer, to establish an unbroken custody trail. This ensures the evidence's integrity and admissibility in court by demonstrating who had access at each stage.

Answer

The forensic tool used to analyze the evidence

Answer

The evidence must be stored in a fireproof safe

Answer

The final analysis report

Question 20

A forensic examiner is analyzing an Android device for potential evidence of a specific app’s data. Which TWO locations within the device’s file system would MOST likely contain application-specific data?

Accepted Answer

/data/data//. Option A is correct because `/data/data//` is the primary internal storage directory for an Android app's private data, including databases, shared preferences, and cached files. This directory is sandboxed per app and requires root access or a backup to read, making it a key forensic target for application-specific evidence.

Answer

/recovery/

Answer

/ (root directory)

Answer

/system/app/