CHFI OS and Network Forensics Practice Test 1 — 15 Questions

Question 1

A security analyst investigates a Windows system and finds an event with ID 4625 in the Security log. What does this event indicate?

Accepted Answer

A failed logon attempt. Event ID 4625 in the Windows Security log specifically indicates a failed logon attempt. This event is generated by the Local Security Authority Subsystem Service (LSASS) whenever an authentication attempt fails, regardless of the logon type (interactive, network, service, etc.). The event details include the account name, source IP address, and failure reason code (e.g., 0xC000006D for bad username/password).

Answer

A successful user logon

Answer

A service was installed

Answer

A new user account was created

Question 2

During a forensic analysis of a compromised Linux server, you notice that the file /var/log/auth.log has been cleared. However, you find that the attacker's commands are still partially recoverable. Which artifact most likely contains the attacker's command history?

Accepted Answer

~/.bash_history. The ~/.bash_history file stores the command history for individual user accounts, including commands executed by an attacker who gained shell access. Even if /var/log/auth.log is cleared, this file retains the attacker's command history unless explicitly deleted or truncated. This makes it a key artifact for recovering attacker activity.

Answer

/var/log/syslog

Answer

/proc/1/cmdline

Answer

/etc/shadow

Question 3

A forensic analyst recovers a USB device from a suspect's computer. Which Windows registry key should be examined to determine the first time the USB device was connected?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under Enum in the SYSTEM hive stores detailed history of USB mass storage devices, including the first connection timestamp via the 'Properties' subkey (e.g., {83da6326-97a6-4088-9453-a1923f573b29} for first install date). This is the definitive location for determining the initial insertion time of a USB device in Windows forensics.

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Question 4

An analyst suspects that an attacker used a web shell to execute commands on a Windows web server. Which Windows event ID should the analyst look for to detect service installation that may have been used for persistence?

Accepted Answer

7045. Event ID 7045 is logged by the Windows Service Control Manager when a new service is installed on the system. An attacker who gains a web shell often installs a malicious service to maintain persistence, and this event captures the service name, binary path, and service type, making it the primary forensic artifact to detect such activity.

Answer

4624

Answer

4648

Answer

4720

Question 5

A forensic examiner is analyzing a Mac system and wants to review system logs that record various activities, including application launches and kernel events. Which logging system on macOS should be examined?

Accepted Answer

Unified logging (log command). Unified logging (log command) is the correct answer because macOS has consolidated all system and user-level logs into a single, high-performance unified logging system since macOS 10.12 (Sierra). This system captures kernel events, application launches, and other activities in a structured, binary format that can be queried using the 'log' command-line tool or the Console app. It is the primary and most comprehensive source for forensic analysis of system activity on modern macOS systems.

Answer

.plist files

Answer

FSEvents

Answer

Console.app logs

Question 6

In Windows forensics, which artifact is used to track recently accessed files and folders via the 'Recent Items' feature?

Accepted Answer

LNK files. D is correct because LNK files (shortcut files) are the primary artifacts created by the Windows 'Recent Items' feature. When a user accesses a file or folder via the GUI (e.g., double-clicking), Windows automatically generates a corresponding .lnk file in the user's `%APPDATA%\Microsoft\Windows\Recent` directory, recording the target path, volume serial number, and timestamps. This makes LNK files the direct forensic evidence of recently accessed items through the Recent Items list.

Answer

Jump lists

Answer

ShellBags

Answer

Prefetch files

Question 7

A network analyst is reviewing a packet capture and sees a large number of TCP SYN packets sent to various ports on a single host from multiple source IPs. This pattern is most indicative of which type of attack?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets with spoofed source IPs to a target host. The target allocates resources for each half-open connection, exhausting its backlog queue and preventing legitimate connections. The pattern of many SYN packets from multiple IPs to various ports matches this attack's signature.

Answer

ARP spoofing

Answer

DNS amplification

Answer

Ping of death

Question 8

During a Linux forensic investigation, you find that the file /etc/cron.d/evil contains the entry: '* * * * * root /bin/bash /root/backdoor.sh'. What persistence mechanism is being used?

Accepted Answer

Cron job. The entry in /etc/cron.d/evil follows the standard crontab format (minute, hour, day, month, weekday, user, command) and is placed in a system cron directory, making it a cron job. Cron jobs are a common Linux persistence mechanism that execute commands at scheduled intervals, and this one runs /root/backdoor.sh every minute as root.

Answer

Systemd service

Answer

Init script

Answer

At job

Question 9

Which of the following Windows registry keys is commonly used by malware to achieve persistence by executing a program at user logon?

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. The HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key is specifically designed to launch programs automatically when the current user logs on. Malware commonly writes a value pointing to its executable under this key to achieve user-level persistence without requiring administrative privileges, as it runs in the context of the logged-on user.

Answer

HKEY_LOCAL_MACHINE\SAM\SAM

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Question 10

In network forensics, which tool is commonly used to analyze and visualize NetFlow data to identify network traffic patterns?

Accepted Answer

SolarWinds NetFlow Traffic Analyzer. SolarWinds NetFlow Traffic Analyzer (NTA) is specifically designed to collect, analyze, and visualize NetFlow data (and other flow protocols like sFlow, IPFIX, and J-Flow) to identify network traffic patterns, bandwidth usage, and top talkers. Unlike packet-level tools, NTA works on flow records exported by routers and switches, making it ideal for high-level traffic pattern analysis in network forensics.

Answer

Wireshark

Answer

Splunk

Answer

Nmap

Question 11

A forensic analyst is examining a Windows system and finds that the UserAssist key in the NTUSER.DAT hive contains entries with Rot13-encoded names. What is the primary purpose of the UserAssist key?

Accepted Answer

Log program execution counts and last run times. The UserAssist key in the NTUSER.DAT hive is designed to track program execution counts and the last time each program was run by the user. The Rot13 encoding of the subkey names is a lightweight obfuscation to hide the logged application paths, but the core purpose remains forensic artifact for user activity timeline reconstruction.

Answer

Record USB device connection history

Answer

Store user password history

Answer

Track recently opened documents via Jump Lists

Question 12

An attacker has compromised a Linux server and edited the /etc/passwd file to change a user's UID to 0. What is the likely goal of this modification?

Accepted Answer

To escalate privileges to root. In Linux, the UID 0 is reserved for the root user, who has unrestricted access to the system. By changing a user's UID to 0, the attacker grants that user the same privileges as root, effectively escalating their access to the highest level. This is a classic privilege escalation technique because the kernel identifies root by UID, not by the username.

Answer

To lock the user account

Answer

To enable password-less login

Answer

To hide the user account from the system

Question 13

A forensic analyst is examining a Windows system and wants to identify recently accessed files and programs. Which TWO artifacts should the analyst prioritize? (Select TWO.)

Accepted Answer

Jump Lists. Jump Lists (A) store recently accessed files and programs per application, providing a direct timeline of user activity. Prefetch files (C) track application launch history and load patterns, allowing the analyst to identify which executables were run and when. Both artifacts are native Windows mechanisms for recording user behavior and are commonly examined in forensic investigations.

Answer

Event ID 4624 logs

Answer

System Restore points

Answer

SAM registry hive

Question 14

A security team is analyzing a compromised Linux server. Indicators suggest the attacker used a web shell. Which THREE of the following are common persistence mechanisms that may be found on the system? (Select THREE.)

Accepted Answer

Adding an SSH public key to /root/.ssh/authorized_keys. Adding an SSH public key to /root/.ssh/authorized_keys allows the attacker to authenticate as root via SSH without a password, providing persistent remote access even if the web shell is removed. This is a common post-exploitation technique because the authorized_keys file is checked by the SSH daemon (sshd) during public key authentication, and the modification survives reboots.

Answer

Modification of the NTUSER.DAT registry hive

Answer

Prefetch file creation

Question 15

An investigator is analyzing a Windows system and wants to find evidence of USB device usage. Which TWO registry keys should be examined? (Select TWO.)

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR registry key under HKLM\SYSTEM\CurrentControlSet\Enum stores a history of all USB storage devices that have ever been connected to the system, including vendor ID, product ID, serial number, and class GUID. This key persists even after the device is removed, making it a primary source for USB device forensics. Option D is correct because the MountPoints2 key under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer stores user-specific mount point information for USB devices, including the drive letter and device label, which can indicate which user connected a particular USB device.

Answer

HKLM\SAM\SAM

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList