CHFI OS and Network Forensics Practice Test 10 — 15 Questions

Question 1

A Windows system is suspected of having malware that maintains persistence by starting every time a user logs in. Which registry key should be examined FIRST for this persistence mechanism?

Accepted Answer

Run keys. The Run keys (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) are the most common and straightforward persistence mechanism for malware that executes on user login. These registry keys specify programs that automatically run when a user logs into their account, making them the first place to check for such persistence.

Answer

ShellBags

Answer

NTUSER.DAT

Answer

HKLM\SAM

Question 2

A forensic analyst finds an LNK file on a Windows system pointing to a script located in a temporary folder. The LNK file's timestamps show creation time after the script's known execution time. What does this discrepancy likely indicate?

Accepted Answer

The LNK file was planted by an attacker to mislead timeline analysis. The LNK file's creation timestamp being after the script's execution time indicates that the LNK file was not created by the normal execution of the script. In Windows, when a user or process accesses a file via a shortcut, the LNK file's timestamps are not updated to reflect the target's execution time. An attacker can plant a pre-created LNK file with a fabricated creation timestamp to mislead forensic timeline analysis, making it appear as if the script was executed at a different time or by a different mechanism.

Answer

The system clock was changed

Answer

The file system is corrupted

Answer

The script was executed normally

Question 3

A security analyst reviews firewall logs and sees repeated outbound connections from an internal server to an external IP on port 443. The server is not supposed to initiate outbound connections. Which action should the analyst take FIRST?

Accepted Answer

Investigate the server for signs of compromise. The server is exhibiting anomalous behavior by initiating outbound connections on port 443 (HTTPS) when it should not be doing so. This is a classic indicator of a potential compromise, such as a command-and-control (C2) callback or data exfiltration. The first priority is to investigate the server for signs of compromise to understand the scope and nature of the threat before taking any disruptive action.

Answer

Block the external IP at the firewall

Answer

Ignore the traffic as it is encrypted

Answer

Disable the server's network connection

Question 4

In Linux forensics, which file contains user account information including the user ID, group ID, home directory, and default shell?

Accepted Answer

/etc/passwd. The /etc/passwd file is the standard Linux user database that stores essential account details, including the username, user ID (UID), group ID (GID), home directory path, and default shell. Each line in this file corresponds to a user account and uses a colon-delimited format (e.g., username:x:UID:GID:comment:home:shell). This file is world-readable because it does not contain passwords (which are stored in /etc/shadow), making it the correct source for the information listed in the question.

Answer

/var/log/auth.log

Answer

/etc/shadow

Answer

/proc/cpuinfo

Question 5

An investigator finds a webshell on a compromised web server. Which artifact would be MOST useful to determine what commands were executed through the webshell?

Accepted Answer

Web server access logs. Web server access logs record every HTTP request made to the server, including the URI, method, user-agent, and response status. When a webshell is accessed, commands are typically passed via GET or POST parameters in the request URL or body, so the access log will contain the exact command strings executed. This makes it the most direct artifact for reconstructing attacker actions.

Answer

Firewall logs

Answer

System event logs

Answer

Prefetch files

Question 6

During a forensic analysis of a Linux system, the investigator finds that the bash_history file is empty for the root user. However, the system has been used actively. What is the MOST likely explanation?

Accepted Answer

The HISTSIZE environment variable is set to 0 or the history file is redirected to /dev/null. The HISTSIZE environment variable controls how many commands are retained in memory during a session. When set to 0, no commands are stored, and the history file (typically ~/.bash_history) remains empty. Alternatively, if HISTFILE is redirected to /dev/null, all history writes are discarded, explaining the empty file despite active use.

Answer

The system was shut down improperly

Answer

The file is corrupted

Answer

The user deleted the history

Question 7

Which TWO Windows Event IDs are associated with successful logon events? (Select two.)

Accepted Answer

4648. Event ID 4648 is logged when a user attempts to log on using explicit credentials, such as running a program as a different user or using the 'runas' command. Event ID 4624 is the standard event for a successful logon, regardless of the logon type (interactive, network, service, etc.). Both indicate successful authentication.

Answer

4625

Answer

7045

Answer

4720

Question 8

A forensic analyst is examining a network packet capture for signs of data exfiltration. Which THREE of the following are common indicators of data exfiltration over DNS? (Select three.)

Accepted Answer

DNS responses with unusually large payloads (e.g., TXT records). C is correct because DNS responses with unusually large payloads, such as oversized TXT records, are a classic indicator of data exfiltration via DNS tunneling. Attackers encode stolen data into the response fields of DNS queries, bypassing traditional security controls by hiding data in protocol fields that are often allowed through firewalls.

Answer

Low TTL values in DNS responses

Answer

DNS queries sent to multiple different DNS servers

Question 9

In a Mac forensic investigation, which TWO artifacts are valuable for determining the timeline of file access? (Select two.)

Accepted Answer

Unified logging. Unified logging (C) is correct because macOS's unified log system records detailed timestamps for file-related events such as opens, closes, and attribute changes via the `log show` command, making it invaluable for reconstructing file access timelines. FSEvents (E) is correct because it logs directory-level changes (e.g., creation, deletion, renaming) with timestamps in the `.fseventsd` directory, providing a high-level chronological record of file system activity.

Answer

ShellBags

Answer

Prefetch files

Answer

NTUSER.DAT

Question 10

Which Windows registry hive stores user-specific configuration and is loaded when a user logs in, containing artifacts such as recently accessed files and application settings?

Accepted Answer

NTUSER.DAT. NTUSER.DAT is the registry hive that contains user-specific settings and is loaded into HKEY_CURRENT_USER upon logon. It includes UserAssist, MRU lists, and other user activity artifacts.

Answer

SECURITY

Answer

HKLM\SAM

Answer

SYSTEM

Question 11

A Linux system administrator notices unusual outbound connections from a server. Which log file should be examined FIRST to identify authentication attempts related to the compromised account?

Accepted Answer

/var/log/auth.log. On Linux systems, /var/log/auth.log (Debian/Ubuntu) is the primary log file that records authentication events, including successful and failed login attempts, sudo usage, and SSH connections. Since the question involves identifying authentication attempts related to a compromised account, this log is the first place to check for evidence of unauthorized access.

Answer

/var/log/messages

Answer

/var/log/secure

Answer

/var/log/syslog

Question 12

During a network forensic investigation, an analyst examines a pcap file and finds multiple TCP SYN packets sent to a target IP on port 80, each from a different source IP address. No SYN-ACK packets are returned, but the target continues to send SYN-ACK responses for earlier packets. What attack is MOST likely occurring?

Accepted Answer

SYN flood attack. The scenario describes a classic SYN flood attack: the attacker sends many TCP SYN packets with spoofed source IP addresses to a target on port 80. The target responds with SYN-ACK packets to each spoofed source, but because the sources are unreachable or non-existent, the target never receives the final ACK to complete the three-way handshake. This leaves the target's connection table filled with half-open connections, exhausting resources and preventing legitimate connections.

Answer

UDP flood attack

Answer

ARP spoofing attack

Answer

DNS amplification attack

Question 13

Which tool is specifically designed for timeline analysis of forensic artifacts across multiple systems and can process output from various forensic tools?

Accepted Answer

log2timeline. log2timeline (now part of the Plaso framework) is specifically designed for super timeline creation, aggregating and correlating timestamps from multiple forensic artifacts across different systems. It can ingest output from tools like The Sleuth Kit, Autopsy, and others to produce a unified, high-resolution timeline for analysis.

Answer

Autopsy

Answer

Wireshark

Answer

Sleuth Kit

Question 14

A forensics examiner finds a suspicious entry in the Windows Registry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to a PowerShell command. Which persistence mechanism does this represent, and what is the MOST likely impact?

Accepted Answer

Registry run key persistence; the command executes each time the user logs in.. The HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard Windows Run key that automatically executes programs when the user logs in. A PowerShell command placed here will run with the user's privileges at each interactive logon, establishing persistence without requiring elevated privileges or system-level access.

Answer

Service persistence; the malware runs as a system service.

Answer

Scheduled task persistence; the command runs at a scheduled time.

Answer

Bootkit persistence; the malware loads before the OS.

Question 15

In Mac forensics, which artifact stores system-wide and per-user application preferences, often used to determine configured settings and recently accessed files?

Accepted Answer

.plist files. In macOS, application and system preferences are stored in property list (.plist) files. These XML or binary files contain key-value pairs that define configured settings, default values, and recently accessed files (e.g., NSRecentDocuments). Forensic examiners parse .plist files to recover user behavior, application usage, and system configuration.

Answer

Unified logging

Answer

Sqlite databases

Answer

FSEvents