CHFI OS and Network Forensics Practice Test 12 — 15 Questions

Question 1

A security analyst observes multiple Event ID 4625 logon failures for a single user account within a short time frame, followed by Event ID 4624 logon success. Which attack technique is MOST likely indicated?

Accepted Answer

Brute-force or password spraying attack. Event ID 4625 indicates failed logon attempts, and a series of these followed by a success (4624) is characteristic of a brute-force or password spraying attack where the attacker eventually guesses the correct password.

Answer

Kerberos golden ticket attack

Answer

SQL injection attack on the authentication database

Answer

Pass-the-hash attack

Question 2

During a forensic investigation, you find a prefetch file created at 03:15:22 UTC on the system. The corresponding executable's last modified timestamp is 02:30:00 UTC, and the system date/time shows a discrepancy of +5 minutes. What is the MOST accurate interpretation regarding the file execution time?

Accepted Answer

The program was executed at 03:15:22 UTC.. Prefetch files record the time the program was first run. The last modified timestamp of the executable is not directly related to execution time. The prefetch timestamp is the best indicator of first execution, but time zone and clock skew must be considered. However, the question asks for the MOST accurate interpretation among the options; the prefetch file creation time directly records when the program was first executed, making that the execution time.

Answer

The program was executed at 02:30:00 UTC.

Answer

Execution time cannot be determined from prefetch files alone.

Answer

The program was executed at 03:10:22 UTC after adjusting for clock skew.

Question 3

Which Windows registry hive stores user-specific configuration and is loaded when a user logs in, containing artifacts such as recently accessed files and application settings?

Accepted Answer

NTUSER.DAT. NTUSER.DAT is the registry hive that contains user-specific settings and is loaded into HKEY_CURRENT_USER upon logon. It includes UserAssist, MRU lists, and other user activity artifacts.

Answer

SECURITY

Answer

HKLM\SAM

Answer

SYSTEM

Question 4

A Linux system administrator notices unusual outbound connections from a server. Which log file should be examined FIRST to identify authentication attempts related to the compromised account?

Accepted Answer

/var/log/auth.log. /var/log/auth.log records authentication-related events such as login attempts, SSH connections, and sudo commands. It is the primary log for investigating unauthorized access.

Answer

/var/log/messages

Answer

/var/log/secure

Answer

/var/log/syslog

Question 5

During a network forensic investigation, an analyst examines a pcap file and finds multiple TCP SYN packets sent to a target IP on port 80, each from a different source IP address. No SYN-ACK packets are returned, but the target continues to send SYN-ACK responses for earlier packets. What attack is MOST likely occurring?

Accepted Answer

SYN flood attack. A SYN flood attack sends many SYN packets without completing the handshake, exhausting the target's connection queue. The different source IPs indicate a distributed SYN flood or IP spoofing.

Answer

UDP flood attack

Answer

ARP spoofing attack

Answer

DNS amplification attack

Question 6

Which tool is specifically designed for timeline analysis of forensic artifacts across multiple systems and can process output from various forensic tools?

Accepted Answer

log2timeline. log2timeline (Plaso) is a tool for creating super timelines from multiple log and artifact sources, enabling analysis of events across time.

Answer

Autopsy

Answer

Wireshark

Answer

Sleuth Kit

Question 7

A forensics examiner finds a suspicious entry in the Windows Registry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to a PowerShell command. Which persistence mechanism does this represent, and what is the MOST likely impact?

Accepted Answer

Registry run key persistence; the command executes each time the user logs in.. The Run key is a common persistence mechanism that executes programs at user logon. A PowerShell command here could execute malicious code each time the user logs in.

Answer

Service persistence; the malware runs as a system service.

Answer

Scheduled task persistence; the command runs at a scheduled time.

Answer

Bootkit persistence; the malware loads before the OS.

Question 8

In Mac forensics, which artifact stores system-wide and per-user application preferences, often used to determine configured settings and recently accessed files?

Accepted Answer

.plist files. .plist files (property lists) are used on macOS to store application preferences and configuration data. They can be analyzed to extract user activity and settings.

Answer

Unified logging

Answer

Sqlite databases

Answer

FSEvents

Question 9

Which Windows Event ID is generated when a new service is installed on the system?

Accepted Answer

7045. Event ID 7045 is logged in the System event log when a service is installed on a Windows system.

Answer

4648

Answer

4720

Answer

4624

Question 10

A forensic analyst is examining a compromised Linux server and finds a suspicious binary running as a service. Which file should be checked to determine if the binary is set to start at boot?

Accepted Answer

/etc/crontab. Cron jobs are used for scheduling tasks; a cron job could be set to run a binary at boot. However, init scripts or systemd services are more common for services. Among the options, crontabs are the most direct for persistence, but the question asks for 'file' from the list. /etc/crontab defines system-wide cron jobs.

Answer

/etc/shadow

Answer

/var/log/auth.log

Answer

/etc/passwd

Question 11

During a network forensics investigation, an analyst reviews NetFlow data and notices a one-way flow of UDP traffic from an internal host to an external IP on port 53. However, the packet capture shows the external IP responding with large DNS responses. What type of data exfiltration technique is MOST likely being used?

Accepted Answer

DNS tunneling. DNS tunneling involves encoding data in DNS queries and responses. The one-way flow observation might be due to NetFlow's view, but the large responses suggest data being returned via DNS responses.

Answer

ICMP tunneling

Answer

SSH tunneling

Answer

HTTP tunneling

Question 12

A forensics investigator finds a suspicious LNK file on a Windows system that points to a script located on a remote share. What is the PRIMARY forensic significance of this LNK file?

Accepted Answer

It may be part of a lateral movement technique using remote execution.. LNK files can be used for persistence or lateral movement. A shortcut to a remote script could indicate the system is configured to run a malicious script from another machine, potentially for propagation.

Answer

It is evidence of USB device insertion.

Answer

It shows the user's recently accessed files.

Answer

It is a prefetch artifact indicating the script was executed.

Question 13

Which TWO artifacts are commonly used to identify USB device insertion history on a Windows system? (Select TWO.)

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR registry key and setupapi.dev.log contain information about USB devices connected to the system, including device IDs and timestamps.

Answer

NTUSER.DAT

Answer

prefetch files

Answer

Event ID 7045

Question 14

Which THREE of the following are indicators of a webshell on a compromised web server? (Select THREE.)

Accepted Answer

Presence of system commands in web server error logs. Webshells are malicious scripts uploaded to a web server. Indicators include anomalous file modifications in web directories, unexpected processes from web server user accounts, and outbound connections from the web server to unknown IPs. CPU spikes can occur but are less specific.

Answer

Multiple failed login attempts in auth.log

Answer

High CPU usage from the web server process

Question 15

Which TWO of the following are typical sources of evidence for network forensics? (Select TWO.)

Accepted Answer

Firewall logs. Network forensics relies on capturing and analyzing network traffic. Packet captures (pcap) and firewall logs are primary sources. IDS logs and NetFlow are also used, but IDS logs are more security-specific, and NetFlow provides flow data. However, the simplest direct sources are packet captures and firewall logs.

Answer

Windows registry hives

Answer

bash_history

Answer

Prefetch files