CHFI OS and Network Forensics Practice Test 11 — 15 Questions

Question 1

A forensic analyst finds a suspicious .plist file in /Library/LaunchDaemons/ on a macOS system. The file contains a key "ProgramArguments" with a path to a script in /tmp. Which persistence mechanism does this indicate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Launch daemon. The .plist file located in /Library/LaunchDaemons/ with a 'ProgramArguments' key pointing to a script in /tmp is the standard configuration for a launch daemon. Launch daemons are system-wide background processes managed by launchd, and they are defined by plist files in /Library/LaunchDaemons/ (for system-wide daemons) or /System/Library/LaunchDaemons/ (for Apple-provided daemons). The presence of 'ProgramArguments' specifies the executable or script to run, making this a classic launch daemon persistence mechanism.

Answer

Cron job

Answer

Login item

Answer

Kernel extension

Question 2

A network forensics analyst captures traffic from a suspected data exfiltration. In Wireshark, filtering for DNS queries containing a long subdomain with base64-encoded text suggests which technique?

Accepted Answer

DNS tunneling. DNS tunneling encodes data (often base64) into DNS query subdomains to bypass network controls and exfiltrate information. Wireshark filtering for unusually long DNS queries with encoded text directly reveals this technique, as legitimate DNS queries rarely contain such payloads.

Answer

DNS hijacking

Answer

DNS poisoning

Answer

DNS amplification

Question 3

Which Windows Registry hive contains user-specific configuration such as MRU lists and UserAssist artifacts?

Accepted Answer

NTUSER.DAT. The NTUSER.DAT file is the registry hive that stores per-user configuration settings, including MRU (Most Recently Used) lists and UserAssist artifacts. When a user logs into a Windows system, this hive is loaded into HKEY_CURRENT_USER (HKCU), making it the primary source for user-specific forensic artifacts such as executed program traces and file access history.

Answer

HKLM\SAM

Answer

SYSTEM

Answer

HKLM\System

Question 4

A forensic examiner recovers a Windows 10 system and finds a prefetch file for powershell.exe with a last run time of 3 days ago, but the system's security logs show no interactive logons from that user. What does this discrepancy suggest?

Accepted Answer

PowerShell was executed as part of a scheduled task or service. A is correct because PowerShell.exe can be executed by non-interactive processes such as scheduled tasks or services, which do not generate interactive logon events (Event ID 4624) in the Security log. The prefetch file records the last run time regardless of the execution context, so a discrepancy between the prefetch timestamp and the absence of interactive logons indicates that PowerShell was launched by a system-level or automated mechanism, not by a user logging on interactively.

Answer

The prefetch file is corrupted

Answer

The user deleted their profile

Answer

The system clock was changed

Question 5

An analyst identifies an unknown binary running on a Linux server. Which /proc filesystem entry would provide the command-line arguments used to start the process?

Accepted Answer

/proc/[pid]/cmdline. /proc/[pid]/cmdline contains the exact command-line arguments used to start the process, stored as null-separated strings. This allows an analyst to see how the binary was invoked, including any flags or parameters, which is critical for identifying malicious or suspicious behavior.

Answer

/proc/[pid]/maps

Answer

/proc/[pid]/status

Answer

/proc/[pid]/environ

Question 6

In a macOS forensic investigation, which log system stores high-level events such as application launches and authentication attempts in a binary format, and can be queried using the 'log' command?

Accepted Answer

Unified logging. Unified logging is the correct answer because macOS stores high-level events like application launches and authentication attempts in a binary format within the unified log system (stored in /var/db/diagnostics/ and /var/db/uuidtext/). The 'log' command is the native tool to query these logs, using predicates and options such as 'log show' or 'log stream', making it the only option that matches both the binary format and the query method described.

Answer

system.log

Answer

Audit log

Answer

FSEvents

Question 7

A security team detects exfiltration via HTTP POST requests to a suspicious domain. Which network forensic technique would BEST identify the data being sent in these requests?

Accepted Answer

Wireshark packet capture with HTTP follow stream. Wireshark packet capture with HTTP follow stream allows the investigator to reassemble the full HTTP conversation, including the body of POST requests. By following the TCP stream, the exact payload (e.g., exfiltrated data) is reconstructed in plain text, making it the best technique to identify the data being sent. This method directly captures and decodes the application-layer content, unlike log-based or flow-based analysis.

Answer

Firewall log review

Answer

IDS alert correlation

Answer

NetFlow analysis

Question 8

During a forensic examination of a compromised Windows server, you find a registry key under HKLM\SYSTEM\CurrentControlSet\Services that points to a malicious DLL. Which event ID would have been generated when this service was installed?

Accepted Answer

7045. Event ID 7045 is logged in the System event log when a new service is installed on a Windows system. This event captures the service name, binary path, and service type, making it the primary forensic artifact for identifying a malicious DLL registered as a service under HKLM\SYSTEM\CurrentControlSet\Services.

Answer

4648

Answer

4720

Answer

4624

Question 9

A Linux investigator wants to see all commands run by a user from the bash shell. Which file should be examined?

Accepted Answer

~/.bash_history. The ~/.bash_history file stores the command history for each user's bash shell session. When a user runs commands in bash, they are appended to this file (typically in the user's home directory) unless history logging is disabled. Examining this file allows an investigator to see the exact commands executed by that specific user from the bash shell.

Answer

/etc/passwd

Answer

/var/log/auth.log

Answer

/var/log/syslog

Question 10

A forensic analyst is examining a Windows system for evidence of USB device usage. Which TWO registry locations are known to store USB device history?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. Option A is correct because HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR is the primary registry key where Windows records USB mass storage devices that have been connected, storing device instance IDs, serial numbers, and vendor/product information used to prove USB storage usage. Option B is correct because HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 tracks per-user mounted volumes, including USB drives, by recording volume GUIDs and drive-letter mappings that correlate a device to a specific user account. Option C is incorrect because the Prefetch registry path does not exist as a USB history store; prefetch execution evidence resides in C:\Windows\Prefetch as .pf files, not in that registry location. Option D is incorrect because HKCU\...\Run is an autostart persistence key for programs launched at logon, not a record of USB device connections. Option E is incorrect because HKLM\SAM\...\Users stores local account and credential-related data (such as RID-based user records and password hashes), not USB device history.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Prefetch

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKLM\SAM\SAM\Domains\Account\Users

Question 11

A security analyst is investigating a potential webshell on an IIS server. Which THREE artifacts are commonly associated with webshell presence?

Accepted Answer

Presence of encoded scripts in the web application directory. Option B is correct because webshells are typically dropped as script files (e.g., .asp, .aspx, .php) in web-accessible directories, and attackers frequently obfuscate or encode them (Base64, gzip, eval/execute blocks) to evade signature detection. Option D is correct because webshell interaction occurs over HTTP, so IIS logs commonly show anomalous POST requests to .asp/.aspx endpoints, often with unusual user agents, parameters, or response sizes indicating command execution. Option E is correct because IIS worker process w3wp.exe spawning cmd.exe or powershell.exe is a classic parent-child anomaly indicating remote command execution through a webshell. Option A is not specific to webshells, since NetFlow to a legitimate update server is normal patching traffic and lacks host-level context. Option C is not indicative either, as Event ID 4624 logons by a service account are routine and do not by themselves evidence webshell activity.

Answer

Increase in NetFlow traffic to a known good update server

Answer

Event ID 4624 logon events from the service account

Question 12

An analyst is reviewing firewall logs and sees repeated outbound connections from an internal host to a known malicious IP on port 443. Which TWO network forensic data sources would BEST help determine if data exfiltration occurred?

Accepted Answer

Full packet capture (PCAP) of the sessions. Option B (Full packet capture (PCAP) of the sessions) is correct because PCAP records the actual bytes of each TCP session on port 443, allowing an analyst to inspect payloads, TLS handshake metadata, certificate details, and transferred content to confirm whether sensitive data left the host. Option E (Proxy logs with TLS interception and decrypted content) is correct because a TLS-intercepting proxy terminates the outbound TLS connection, decrypts the HTTP/HTTPS traffic, and logs URLs, methods, request/response bodies, and uploaded data, which directly reveals exfiltration over 443. Option A is not among the marked correct answers: flow records only show metadata such as byte/packet counts and timing, which can suggest large transfers but cannot confirm exfiltration content. Option C is not marked correct because IDS signature alerts indicate suspicious activity but do not by themselves prove that data was exfiltrated. Option D is not marked correct because Windows security event logs focus on host authentication, account, and policy events rather than the contents or destinations of outbound TLS sessions.

Answer

Network flow records showing packet sizes and counts

Answer

IDS alerts for signatures

Answer

Windows security event logs

Question 13

A security analyst reviews Windows Event Logs and sees Event ID 4625 multiple times for a single user account from a remote IP address within a short time frame. What is the MOST likely interpretation?

Accepted Answer

An attacker is attempting to brute-force the user's password. Event ID 4625 indicates a failed logon attempt. Multiple occurrences for the same user from a single remote IP within a short timeframe is the classic signature of a brute-force attack, where an attacker systematically tries different passwords against that account.

Answer

The user successfully logged on from multiple locations

Answer

The system is experiencing a denial-of-service attack

Answer

A service installed itself on the system

Question 14

During a forensic investigation, you find a file named ntuser.dat.LOG1 in a user's profile directory. What is the primary purpose of this file?

Accepted Answer

It logs changes to the user's registry hive for recovery purposes. The ntuser.dat.LOG1 file is a transactional log file used by the Windows registry to record changes made to the corresponding user's registry hive (ntuser.dat). Its primary purpose is to ensure data integrity and enable recovery of the hive in case of a system crash or power failure during a write operation, by allowing the registry to replay or roll back incomplete transactions.

Answer

It contains the user's Internet browsing history

Answer

It is a backup copy of the user's registry hive

Answer

It stores the user's recently accessed files

Question 15

An analyst captures network traffic during an incident and wants to extract files transferred over HTTP. Which Wireshark feature is BEST suited for this task?

Accepted Answer

Export Objects > HTTP. Wireshark's 'Export Objects > HTTP' feature is specifically designed to extract files (e.g., images, documents, executables) transferred over HTTP by reassembling the TCP streams and parsing the HTTP response bodies. This feature automates the extraction process, saving the analyst from manually reconstructing each file from raw packets.

Answer

Follow TCP Stream

Answer

Statistics > HTTP

Answer

Analyze > Expert Info