CHFI OS and Network Forensics — 50 Questions

Question 1

A security analyst investigates a Windows system and finds an event with ID 4625 in the Security log. What does this event indicate?

Accepted Answer

A failed logon attempt. Event ID 4625 in the Windows Security log specifically indicates a failed logon attempt. This event is generated by the Local Security Authority Subsystem Service (LSASS) whenever an authentication attempt fails, regardless of the logon type (interactive, network, service, etc.). The event details include the account name, source IP address, and failure reason code (e.g., 0xC000006D for bad username/password).

Answer

A successful user logon

Answer

A service was installed

Answer

A new user account was created

Question 2

During a forensic analysis of a compromised Linux server, you notice that the file /var/log/auth.log has been cleared. However, you find that the attacker's commands are still partially recoverable. Which artifact most likely contains the attacker's command history?

Accepted Answer

~/.bash_history. The ~/.bash_history file stores the command history for individual user accounts, including commands executed by an attacker who gained shell access. Even if /var/log/auth.log is cleared, this file retains the attacker's command history unless explicitly deleted or truncated. This makes it a key artifact for recovering attacker activity.

Answer

/var/log/syslog

Answer

/proc/1/cmdline

Answer

/etc/shadow

Question 3

A forensic analyst recovers a USB device from a suspect's computer. Which Windows registry key should be examined to determine the first time the USB device was connected?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under Enum in the SYSTEM hive stores detailed history of USB mass storage devices, including the first connection timestamp via the 'Properties' subkey (e.g., {83da6326-97a6-4088-9453-a1923f573b29} for first install date). This is the definitive location for determining the initial insertion time of a USB device in Windows forensics.

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Question 4

An analyst suspects that an attacker used a web shell to execute commands on a Windows web server. Which Windows event ID should the analyst look for to detect service installation that may have been used for persistence?

Accepted Answer

7045. Event ID 7045 is logged by the Windows Service Control Manager when a new service is installed on the system. An attacker who gains a web shell often installs a malicious service to maintain persistence, and this event captures the service name, binary path, and service type, making it the primary forensic artifact to detect such activity.

Answer

4624

Answer

4648

Answer

4720

Question 5

A forensic examiner is analyzing a Mac system and wants to review system logs that record various activities, including application launches and kernel events. Which logging system on macOS should be examined?

Accepted Answer

Unified logging (log command). Unified logging (log command) is the correct answer because macOS has consolidated all system and user-level logs into a single, high-performance unified logging system since macOS 10.12 (Sierra). This system captures kernel events, application launches, and other activities in a structured, binary format that can be queried using the 'log' command-line tool or the Console app. It is the primary and most comprehensive source for forensic analysis of system activity on modern macOS systems.

Answer

.plist files

Answer

FSEvents

Answer

Console.app logs

Question 6

In Windows forensics, which artifact is used to track recently accessed files and folders via the 'Recent Items' feature?

Accepted Answer

LNK files. D is correct because LNK files (shortcut files) are the primary artifacts created by the Windows 'Recent Items' feature. When a user accesses a file or folder via the GUI (e.g., double-clicking), Windows automatically generates a corresponding .lnk file in the user's `%APPDATA%\Microsoft\Windows\Recent` directory, recording the target path, volume serial number, and timestamps. This makes LNK files the direct forensic evidence of recently accessed items through the Recent Items list.

Answer

Jump lists

Answer

ShellBags

Answer

Prefetch files

Question 7

A network analyst is reviewing a packet capture and sees a large number of TCP SYN packets sent to various ports on a single host from multiple source IPs. This pattern is most indicative of which type of attack?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets with spoofed source IPs to a target host. The target allocates resources for each half-open connection, exhausting its backlog queue and preventing legitimate connections. The pattern of many SYN packets from multiple IPs to various ports matches this attack's signature.

Answer

ARP spoofing

Answer

DNS amplification

Answer

Ping of death

Question 8

During a Linux forensic investigation, you find that the file /etc/cron.d/evil contains the entry: '* * * * * root /bin/bash /root/backdoor.sh'. What persistence mechanism is being used?

Accepted Answer

Cron job. The entry in /etc/cron.d/evil follows the standard crontab format (minute, hour, day, month, weekday, user, command) and is placed in a system cron directory, making it a cron job. Cron jobs are a common Linux persistence mechanism that execute commands at scheduled intervals, and this one runs /root/backdoor.sh every minute as root.

Answer

Systemd service

Answer

Init script

Answer

At job

Question 9

Which of the following Windows registry keys is commonly used by malware to achieve persistence by executing a program at user logon?

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. The HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key is specifically designed to launch programs automatically when the current user logs on. Malware commonly writes a value pointing to its executable under this key to achieve user-level persistence without requiring administrative privileges, as it runs in the context of the logged-on user.

Answer

HKEY_LOCAL_MACHINE\SAM\SAM

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Question 10

In network forensics, which tool is commonly used to analyze and visualize NetFlow data to identify network traffic patterns?

Accepted Answer

SolarWinds NetFlow Traffic Analyzer. SolarWinds NetFlow Traffic Analyzer (NTA) is specifically designed to collect, analyze, and visualize NetFlow data (and other flow protocols like sFlow, IPFIX, and J-Flow) to identify network traffic patterns, bandwidth usage, and top talkers. Unlike packet-level tools, NTA works on flow records exported by routers and switches, making it ideal for high-level traffic pattern analysis in network forensics.

Answer

Wireshark

Answer

Splunk

Answer

Nmap

Question 11

A forensic analyst is examining a Windows system and finds that the UserAssist key in the NTUSER.DAT hive contains entries with Rot13-encoded names. What is the primary purpose of the UserAssist key?

Accepted Answer

Log program execution counts and last run times. The UserAssist key in the NTUSER.DAT hive is designed to track program execution counts and the last time each program was run by the user. The Rot13 encoding of the subkey names is a lightweight obfuscation to hide the logged application paths, but the core purpose remains forensic artifact for user activity timeline reconstruction.

Answer

Record USB device connection history

Answer

Store user password history

Answer

Track recently opened documents via Jump Lists

Question 12

An attacker has compromised a Linux server and edited the /etc/passwd file to change a user's UID to 0. What is the likely goal of this modification?

Accepted Answer

To escalate privileges to root. In Linux, the UID 0 is reserved for the root user, who has unrestricted access to the system. By changing a user's UID to 0, the attacker grants that user the same privileges as root, effectively escalating their access to the highest level. This is a classic privilege escalation technique because the kernel identifies root by UID, not by the username.

Answer

To lock the user account

Answer

To enable password-less login

Answer

To hide the user account from the system

Question 13

A forensic analyst is examining a Windows system and wants to identify recently accessed files and programs. Which TWO artifacts should the analyst prioritize? (Select TWO.)

Accepted Answer

Jump Lists. Jump Lists (A) store recently accessed files and programs per application, providing a direct timeline of user activity. Prefetch files (C) track application launch history and load patterns, allowing the analyst to identify which executables were run and when. Both artifacts are native Windows mechanisms for recording user behavior and are commonly examined in forensic investigations.

Answer

Event ID 4624 logs

Answer

System Restore points

Answer

SAM registry hive

Question 14

A security team is analyzing a compromised Linux server. Indicators suggest the attacker used a web shell. Which THREE of the following are common persistence mechanisms that may be found on the system? (Select THREE.)

Accepted Answer

Adding an SSH public key to /root/.ssh/authorized_keys. Adding an SSH public key to /root/.ssh/authorized_keys allows the attacker to authenticate as root via SSH without a password, providing persistent remote access even if the web shell is removed. This is a common post-exploitation technique because the authorized_keys file is checked by the SSH daemon (sshd) during public key authentication, and the modification survives reboots.

Answer

Modification of the NTUSER.DAT registry hive

Answer

Prefetch file creation

Question 15

An investigator is analyzing a Windows system and wants to find evidence of USB device usage. Which TWO registry keys should be examined? (Select TWO.)

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR registry key under HKLM\SYSTEM\CurrentControlSet\Enum stores a history of all USB storage devices that have ever been connected to the system, including vendor ID, product ID, serial number, and class GUID. This key persists even after the device is removed, making it a primary source for USB device forensics. Option D is correct because the MountPoints2 key under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer stores user-specific mount point information for USB devices, including the drive letter and device label, which can indicate which user connected a particular USB device.

Answer

HKLM\SAM\SAM

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Question 16

During a forensic investigation of a compromised Linux server, you find the following entry in /var/log/auth.log: 'Mar 10 03:14:15 server sshd[1234]: Accepted publickey for root from 10.0.0.5 port 54321 ssh2: RSA SHA256:AbCdEf123456'. Which artifact should you examine next to determine if unauthorized key-based access occurred?

Accepted Answer

~/.ssh/authorized_keys. The log entry shows a successful public key authentication from root. To determine if this key-based access was unauthorized, you must examine the ~/.ssh/authorized_keys file for the root user. This file contains the public keys that are authorized to log in as root; if the key fingerprint SHA256:AbCdEf123456 is present, the access was legitimate; if absent, it indicates an unauthorized key was added by an attacker.

Answer

/var/log/syslog

Answer

/etc/ssh/sshd_config

Answer

/etc/passwd

Question 17

Which Windows artifact is primarily used to determine the execution history of applications, including the path and run count?

Accepted Answer

Prefetch files. Prefetch files (.pf) are created by Windows to speed up application startup by caching data about the files loaded during the first few seconds of execution. Each prefetch file records the application's path, the number of times it has been run (run count), and the last execution timestamp, making it the primary artifact for determining execution history.

Answer

LNK files

Answer

Jump lists

Answer

Event logs

Question 18

A forensic analyst discovers an unusual entry in the Windows Registry under 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run'. Which persistence mechanism does this represent?

Accepted Answer

Registry Run key persistence. The registry key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' is a standard Windows Registry Run key that automatically launches specified programs when a user logs in. This is a well-known persistence mechanism used by both legitimate software and malware to maintain foothold on a system. The presence of an unusual entry here indicates an attempt to achieve persistence via the registry.

Answer

Service installation

Answer

Scheduled task

Answer

Startup folder

Question 19

A network forensic analyst examines a pcap file in Wireshark and sees an HTTP POST request to '/shell.jsp' with a parameter 'cmd' containing 'dir'. The response contains a directory listing. Which intrusion artifact is indicated?

Accepted Answer

Webshell. The HTTP POST request to '/shell.jsp' with a 'cmd' parameter containing 'dir' and a response showing a directory listing is a classic indicator of a webshell. A webshell is a malicious script (e.g., JSP, ASP, PHP) uploaded to a web server that allows an attacker to execute arbitrary system commands via HTTP requests, effectively providing remote command execution. The presence of a command parameter and the server's response executing that command directly confirms the artifact is a webshell.

Answer

SQL injection

Answer

Directory traversal

Answer

Cross-site scripting (XSS)

Question 20

During a Linux forensic investigation, you find a suspicious cron job in /etc/cron.d/malware that runs every 5 minutes as root. Which persistence mechanism is being used?

Accepted Answer

Cron job. The cron daemon reads job definitions from files in /etc/cron.d/ and executes them according to the schedule specified. Finding a file named 'malware' in /etc/cron.d/ that runs every 5 minutes as root directly indicates a cron job persistence mechanism, as this is the standard location for system-wide cron entries.

Answer

Bash history

Answer

Systemd service

Answer

Init script