CHFI OS and Network Forensics Practice Test 10 — 15 Questions

Question 1

A security analyst reviews Windows Event Logs and sees Event ID 4625 multiple times for a single user account from a remote IP address within a short time frame. What is the MOST likely interpretation?

Accepted Answer

An attacker is attempting to brute-force the user's password. Event ID 4625 indicates a failed logon attempt. Multiple occurrences from the same remote IP suggest a brute-force password guessing attack.

Answer

The user successfully logged on from multiple locations

Answer

The system is experiencing a denial-of-service attack

Answer

A service installed itself on the system

Question 2

During a forensic investigation, you find a file named ntuser.dat.LOG1 in a user's profile directory. What is the primary purpose of this file?

Accepted Answer

It logs changes to the user's registry hive for recovery purposes. NTUSER.DAT.LOG1 is a transaction log file used to ensure registry consistency in case of a crash. It records changes before they are committed.

Answer

It contains the user's Internet browsing history

Answer

It is a backup copy of the user's registry hive

Answer

It stores the user's recently accessed files

Question 3

A Linux system administrator notices unusual outbound connections from a server. Which of the following commands would MOST effectively capture a list of all current network connections along with the associated process IDs?

Accepted Answer

sudo ss -tunap. The 'ss -tunap' command displays TCP/UDP sockets with process information. 'netstat -tunap' is similar but deprecated on many systems. 'lsof -i' shows open files for network connections.

Answer

sudo iptables -L

Answer

sudo lsmod

Answer

sudo ifconfig -a

Question 4

A forensic analyst is investigating a Windows 10 system and needs to determine if a USB device was ever connected. Which registry key would provide a comprehensive list of USB devices that have been attached, including the first and last connection times?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key records all USB storage devices with timestamps. Enum/USB contains device descriptors but not timestamps. SetupAPI logs are in a different location.

Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USB

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles

Question 5

An analyst captures network traffic during an incident and wants to extract files transferred over HTTP. Which Wireshark feature is BEST suited for this task?

Accepted Answer

Export Objects > HTTP. Wireshark's 'Export Objects' feature allows extraction of files transferred via HTTP, SMB, etc. 'Follow TCP Stream' shows the stream content but does not export files.

Answer

Follow TCP Stream

Answer

Statistics > HTTP

Answer

Analyze > Expert Info

Question 6

During a forensic examination of a macOS system, an investigator wants to review application execution history. Which artifact contains a chronological record of application launches, including timestamps and process IDs?

Accepted Answer

Unified logging (log command). macOS unified logging provides detailed system activity including application launches. FSEvents records file system changes but not process launches. .plist files may store settings, not execution history.

Answer

FSEvents

Answer

com.apple.launchd.plist

Answer

syslog

Question 7

A security team detects a suspicious process that writes to the Windows registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run. What is the MOST likely purpose of this activity?

Accepted Answer

Establishing persistence for malware. The Run key is a common auto-start location used for persistence. Writing to it ensures the process executes at user logon.

Answer

Clearing browser history

Answer

Updating system time

Answer

Configuring firewall rules

Question 8

Which Linux log file is the PRIMARY source for authentication-related events such as user logins, sudo usage, and failed authentication attempts?

Accepted Answer

/var/log/auth.log. /var/log/auth.log (or /var/log/secure on RHEL) stores authentication logs. /var/log/syslog contains general system messages. /var/log/kern.log is for kernel messages.

Answer

/var/log/kern.log

Answer

/var/log/syslog

Answer

/var/log/boot.log

Question 9

A forensic analyst is examining a Windows system and finds a prefetch file named NOTEPAD.EXE-12345678.pf. What information can be gleaned from this artifact? (Select the BEST answer.)

Accepted Answer

It records the application's execution count and last run time. Prefetch files contain the number of times the application was run, last run time, and a list of files loaded during execution. They do not store network connections or user-specific data.

Answer

It saves a copy of the application's configuration

Answer

It logs all network connections made by the application

Answer

The file contains the user's password for the application

Question 10

During a network breach investigation, an analyst examines NetFlow records and sees large data transfers from a server to an external IP address during off-hours. Which type of activity does this MOST likely indicate?

Accepted Answer

Data exfiltration by an attacker. Large off-hours data transfers to an external IP are typical of data exfiltration. Normal backup traffic may occur but is usually scheduled and to known destinations.

Answer

Normal software update download

Answer

Scheduled backup to a cloud service

Answer

Denial-of-service attack against the server

Question 11

A forensic analyst needs to create a timeline of file system activity from a disk image. Which tool is specifically designed for this purpose and can parse various artifacts such as registry, prefetch, and log files?

Accepted Answer

Plaso (log2timeline). Plaso (log2timeline) is a super timeline tool that parses multiple artifacts to create a comprehensive timeline. Wireshark is for network packets. FTK Imager is for acquisition. Volatility is for memory analysis.

Answer

Wireshark

Answer

Volatility

Answer

FTK Imager

Question 12

An incident responder examines a Linux server and finds a suspicious cron job that runs every minute and executes a script located in /tmp. Which persistence technique does this represent?

Accepted Answer

Cron-based persistence. Cron jobs are a common persistence mechanism on Linux. Attackers often use frequent cron jobs to maintain access.

Answer

Kernel rootkit

Answer

Web shell

Answer

SSH key backdoor

Question 13

Which TWO Windows registry hives are most commonly analyzed during a forensic investigation to determine user activity and system configuration? (Select TWO.)

Accepted Answer

HKLM\SAM. SAM stores user account hashes, NTUSER.DAT contains user-specific settings, SYSTEM stores system configuration, SOFTWARE stores installed software info.

Answer

HKU\.DEFAULT

Answer

HKLM\COMPONENTS

Answer

HKLM\BCD

Question 14

Which THREE of the following are common indicators of a web shell presence on a compromised IIS web server? (Select THREE.)

Accepted Answer

Process w3wp.exe making outbound connections to an unknown IP. Web shells often create anomalous files in web directories, processes running as w3wp.exe executing suspicious commands, and outbound connections to C2 servers. Normal activity includes log entries for legitimate requests.

Answer

Increased 404 errors in HTTP logs

Answer

Normal GET requests to static .html pages

Question 15

Which TWO of the following are primary locations for browser history artifacts in a Windows 10 system? (Select TWO.)

Accepted Answer

%USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\History. Chrome history is in SQLite database files; Edge uses WebCacheV01.dat; Firefox uses places.sqlite.

Answer

%USERPROFILE%\AppData\Local\Microsoft\Windows\Temporary Internet Files

Answer

%USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\*.default\places.sqlite

Answer

%USERPROFILE%\AppData\Local\Temp