CHFI Practice Exam 62 — 20 Questions

Question 1

A malware analyst is examining a PE file that has a section named '.tls' and imports from 'kernel32.dll' and 'ntdll.dll'. The entry point points to a small stub that decrypts the main code at runtime. Which of the following best describes this technique?

Accepted Answer

TLS callback-based decryption. The presence of a '.tls' section in a PE file, combined with imports from kernel32.dll and ntdll.dll, indicates the use of Thread Local Storage (TLS) callbacks. These callbacks execute before the entry point, allowing the malware to decrypt the main code at runtime before the main executable logic runs. This is a classic TLS callback-based decryption technique, not a form of code injection or packing.

Answer

Code injection via Reflective DLL

Answer

Packing with UPX

Answer

Anti-debugging via NtGlobalFlag

Question 2

An analyst is performing malware analysis and executes a suspicious binary in a sandbox. The sandbox reports that the binary creates a mutex named 'Global\DRIVER_UPDATE_MTX' before attempting to connect to 'http://malicious.com/update'. Which tool would BEST capture the network traffic during dynamic analysis?

Accepted Answer

Wireshark. Wireshark is the correct tool because it captures and analyzes network packets at the protocol level, allowing the analyst to inspect the HTTP request to 'http://malicious.com/update', including headers, payload, and any subsequent data exfiltration. Dynamic analysis of malware requires monitoring network traffic to identify command-and-control (C2) communications, and Wireshark provides full packet capture (PCAP) for this purpose.

Answer

Regshot

Answer

Process Explorer

Answer

Process Monitor

Question 3

Which TWO of the following are valid acquisition types in mobile forensics, ranked from most to least data recovered?

Accepted Answer

Physical. Physical acquisition (option B) captures the entire flash memory bit-for-bit, including deleted files and unallocated space, providing the most complete data recovery. Logical acquisition (option D) extracts only active files and system data via the operating system's API, yielding less data than physical but more than manual or cloud methods. Together, they represent the two valid acquisition types ranked from most to least data recovered in mobile forensics.

Answer

Manual

Answer

Cloud

Answer

File system

Question 4

A forensic examiner is analyzing an Android device and needs to extract application data from the /data/data/ directory. Which TWO conditions must be met to access this directory? (Select TWO.)

Accepted Answer

USB debugging must be enabled. The /data/data/ directory on Android contains application private data, which is protected by Linux user permissions (UID/GID) and SELinux policies. USB debugging must be enabled (Option A) to allow the forensic workstation to communicate with the device via ADB (Android Debug Bridge) for command execution. The device must be rooted (Option B) because the /data/data/ directory is owned by the system and individual app UIDs, and only a root user (UID 0) can bypass these permissions to read all application data.

Answer

The device must be in recovery mode

Answer

The bootloader must be unlocked

Answer

The screen must be unlocked

Question 5

During a malware investigation, an analyst identifies a suspicious file that appears to be a Windows executable. Using PEiD, the analyst detects the file is packed with UPX. After unpacking, the analyst runs the file in a sandbox and observes it modifies the following registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MalService. What behavioural indicator is primarily demonstrated?

Accepted Answer

Persistence mechanism. The modification of the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MalService is a classic persistence mechanism. By adding an entry to the Run key, the malware ensures that it executes automatically every time the user logs into the system, maintaining its presence across reboots.

Answer

Command and control communication

Answer

Anti-forensic technique (timestomping)

Answer

Privilege escalation attempt

Question 6

During an Android forensic examination, an analyst uses ADB to perform a backup of a device. The resulting .ab file is encrypted. Which of the following is the most likely reason for the encryption?

Accepted Answer

The device has a lock screen PIN set, and the backup was created with default settings. When an Android backup is created via ADB with default settings, the resulting .ab file is encrypted using the device's lock screen PIN or password as the encryption key. This is a built-in security feature of the Android Backup Manager to protect backup data from unauthorized access. The encryption is applied regardless of whether full-disk encryption is enabled, as it is a separate layer of protection for the backup stream.

Answer

The backup was created with the -nopassword flag

Answer

The backup file is corrupted

Answer

The device has full-disk encryption enabled

Question 7

During an iOS forensic examination, an analyst extracts the SMS.db file from an iTunes backup. Which table within this database contains the actual message content and associated metadata such as timestamps and sender/recipient information?

Accepted Answer

message. The `message` table in SMS.db stores the actual message content (the `text` field) along with critical metadata such as `date` (Unix timestamp), `is_from_me` (sender/recipient indicator), and `handle_id` (foreign key to the `handle` table). This is the primary table for message body and timestamp data in iOS SMS/MMS forensics.

Answer

chat

Answer

attachment

Answer

handle

Question 8

A forensic analyst is examining a malware sample that uses packing to obfuscate its code. Which static analysis tool is BEST suited to identify the packer used and potentially unpack the executable?

Accepted Answer

PEiD. PEiD (Portable Executable Identifier) is specifically designed to detect packers, cryptors, and compilers used in PE files by scanning for known signatures in the executable's entry point. It is the best static analysis tool for identifying the packer and can often unpack the executable using its built-in generic unpacker or by invoking the packer's own unpacking stub. This makes it ideal for the initial triage of packed malware samples.

Answer

Cuckoo Sandbox

Answer

Ghidra

Answer

IDA Pro

Question 9

In static malware analysis, what is the purpose of using a tool like PEiD?

Accepted Answer

To detect packers or compilers used in the PE file. PEiD is a static analysis tool that identifies packers, cryptors, and compilers embedded in Portable Executable (PE) files by scanning for known signatures in the file's entry point and section headers. This helps an analyst understand whether the malware is packed (obfuscated) and what tool was used to create or compress it, which is critical before attempting dynamic analysis or unpacking.

Answer

To monitor registry changes during execution

Answer

To disassemble the binary into assembly code

Answer

To analyze network traffic generated by the malware

Question 10

A forensic examiner is analyzing an iOS device backup and wants to extract the user's iCloud-related artefacts. Which TWO of the following are typical sources of iCloud artefacts in an iTunes backup?

Accepted Answer

com.apple.accounts.plist. Option B is correct because the `com.apple.accounts.plist` file in an iTunes backup stores the user's iCloud account configuration, including the primary iCloud email address and associated account metadata. This plist is a direct source for identifying which iCloud account was configured on the device, making it a key artefact for iCloud-related analysis.

Answer

AddressBook.db

Answer

Call_history.db

Answer

SMS.db

Question 11

A security analyst notices a process named 'svchost.exe' running from the directory 'C:\Users\Public\svchost.exe'. This is suspicious because legitimate svchost.exe runs from 'C:\Windows\System32'. What type of indicator is this?

Accepted Answer

Behavioural indicator. B is correct because the presence of svchost.exe in C:\Users\Public\ instead of C:\Windows\System32 indicates a deviation from the expected execution path, which is a classic behavioral indicator. Behavioral indicators focus on anomalous actions or file placements rather than static attributes like hashes or network traffic.

Answer

Network indicator

Answer

File hash indicator

Answer

Registry key indicator

Question 12

During an Android forensic examination, the analyst uses ADB to run 'adb shell dumpsys batterystats --reset' before acquiring data. What is the MOST likely purpose of this command?

Accepted Answer

This command is not recommended in forensic acquisition as it may destroy potential evidence. Option B is correct because the 'adb shell dumpsys batterystats --reset' command clears the battery statistics logs on the device. In forensic acquisition, any command that modifies or deletes data on the device is considered destructive to evidence. The reset operation removes historical battery data that may contain timestamps and app usage patterns, which could be critical evidence. Therefore, this command is not recommended in forensic acquisition as it may destroy potential evidence.

Answer

To clear battery logs that may contain evidence of app activity

Answer

To ensure the device is in a low-power state for safe extraction

Answer

To optimize device performance during imaging

Question 13

A security team is investigating a suspected Advanced Persistent Threat (APT) intrusion. They have identified several IoCs. Which THREE of the following are considered standard types of Indicators of Compromise?

Accepted Answer

IP address of a command and control server. Option B is correct because IP addresses of command and control (C2) servers are a standard type of Indicator of Compromise (IoC). They represent network-based IoCs that allow defenders to identify and block communication between compromised hosts and attacker-controlled infrastructure, often used in conjunction with firewall logs or DNS queries.

Answer

Employee badge number

Answer

Email subject line from a phishing campaign

Question 14

A forensic analyst is examining an Android device that has been factory reset. Which of the following artefacts is MOST likely to persist after a factory reset and provide valuable evidence?

Accepted Answer

Google account authentication tokens and sync settings. Google account authentication tokens and sync settings are stored in the device's internal flash memory within the 'accounts.db' database and the 'authtoken' table, which are not wiped by a standard factory reset because the reset only clears user data partitions but does not overwrite the underlying NAND flash blocks. These tokens can survive a reset if the device was previously synced with Google servers, allowing recovery of the Google account credentials and sync configurations, which are critical for linking the device to a user identity.

Answer

Deleted SMS messages from the mmssms.db WAL file

Answer

The contents of the SD card's Android/data directory

Answer

The user's pattern lock hash stored in gatekeeper.password.key

Question 15

A security analyst suspects a mobile device is infected with malware that exfiltrates data via DNS queries. Which tool or technique would be MOST effective for detecting this behavior during dynamic analysis?

Accepted Answer

Wireshark to capture and analyze network packets for anomalous DNS queries. D is correct because DNS exfiltration involves encoding stolen data into DNS query fields (e.g., subdomains or TXT records) and sending them to a malicious server. Wireshark captures and analyzes raw network packets, allowing the analyst to inspect DNS query payloads for anomalous patterns such as unusually long hostnames, high query volume, or queries to suspicious domains, which are hallmarks of DNS tunneling.

Answer

PEiD to detect packers in the mobile app binary

Answer

Regshot to compare registry snapshots before and after execution

Answer

Process Monitor to observe registry and file system changes

Question 16

An iOS forensic examiner recovers a Keychain dump from an iPhone. Which of the following types of data is typically NOT stored in the iOS Keychain?

Accepted Answer

SMS message content. The iOS Keychain is designed to store small, sensitive credentials such as passwords, keys, and certificates. SMS message content is stored in the SMS/MMS database (sms.db) under the protected /private/var/mobile/Library/SMS/ directory, not in the Keychain. Keychain items are encrypted per-app or per-service, whereas SMS messages are managed by the Messages app and stored in a SQLite database with its own encryption layer.

Answer

Wi-Fi passwords

Answer

Safari saved passwords

Answer

VPN credentials

Question 17

An investigator examines an iPhone backup file. Inside the backup manifest, they find a file path 'AppDomainGroup-group.com.example.app'. This indicates the data belongs to which type of app container?

Accepted Answer

A shared container for multiple apps from the same developer. The file path 'AppDomainGroup-group.com.example.app' indicates a shared container used by App Groups, a feature that allows multiple apps from the same developer to share data. This is not a sandbox container for a single app, nor is it a system or temporary container. The 'group' prefix and the bundle identifier pattern confirm it belongs to a shared app group container.

Answer

System container for iOS system apps

Answer

The app's sandbox container

Answer

Temporary container for app data

Question 18

Which mobile forensic tool is commonly used for physical extraction of iOS devices via checkm8 exploit?

Accepted Answer

GrayKey. GrayKey is correct because it is a dedicated forensic tool that leverages the checkm8 bootrom exploit (CVE-2019-15971) to perform physical extraction on iOS devices. The checkm8 exploit is unpatchable in hardware, allowing GrayKey to bypass the device's security enclave and extract a full file system image, including encrypted data, from iPhones up to the iPhone X.

Answer

Cellebrite UFED

Answer

Magnet AXIOM

Answer

Oxygen Forensic Detective

Question 19

Which tool is specifically designed to perform physical extraction of data from mobile devices, including bypassing lock screens on many iOS and Android devices?

Accepted Answer

Cellebrite UFED. Cellebrite UFED (Universal Forensic Extraction Device) is a specialized hardware and software tool designed for physical extraction of data from mobile devices, including bypassing lock screen security on iOS and Android devices. It uses advanced techniques such as bootloader exploits, JTAG, chip-off, and proprietary software-based methods to acquire full file system images, even when the device is locked or encrypted.

Answer

SIFT Workstation

Answer

FTK Imager

Answer

Wireshark

Question 20

During a malware analysis session, an analyst uses a tool to view the import address table (IAT) of a suspicious PE file. The tool shows imports from ws2_32.dll and wininet.dll. Which of the following tools would BEST allow the analyst to statically analyze the binary and view the IAT?

Accepted Answer

PEiD. PEiD (Portable Executable Identifier) is a static analysis tool that can parse the PE file structure, including the Import Address Table (IAT), to reveal which DLLs and functions are imported. Since the question specifies static analysis and viewing the IAT, PEiD is the best choice because it directly reads the PE headers without executing the file.

Answer

Wireshark

Answer

Process Monitor

Answer

Cuckoo Sandbox