CHFI OS and Network Forensics Practice Test 12 — 15 Questions

Question 1

A security team detects a suspicious process that writes to the Windows registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run. What is the MOST likely purpose of this activity?

Accepted Answer

Establishing persistence for malware. The Run key is a common auto-start location used for persistence. Writing to it ensures the process executes at user logon.

Answer

Clearing browser history

Answer

Updating system time

Answer

Configuring firewall rules

Question 2

Which Linux log file is the PRIMARY source for authentication-related events such as user logins, sudo usage, and failed authentication attempts?

Accepted Answer

/var/log/auth.log. /var/log/auth.log is the primary log file on Linux systems (especially Debian/Ubuntu) that records authentication-related events, including user logins (via sshd, login, su), sudo command executions, and failed authentication attempts. This log is generated by the authpriv facility in syslog and is specifically designed to capture security and authentication messages, making it the go-to source for forensic analysis of user access and privilege escalation.

Answer

/var/log/kern.log

Answer

/var/log/syslog

Answer

/var/log/boot.log

Question 3

A forensic analyst is examining a Windows system and finds a prefetch file named NOTEPAD.EXE-12345678.pf. What information can be gleaned from this artifact? (Select the BEST answer.)

Accepted Answer

It records the application's execution count and last run time. Prefetch files in Windows are designed to speed up application startup by caching information about the files loaded during the first few seconds of execution. The filename includes the application name and a hash of the file path, while the internal metadata records the execution count and last run time, making option C correct.

Answer

It saves a copy of the application's configuration

Answer

It logs all network connections made by the application

Answer

The file contains the user's password for the application

Question 4

During a network breach investigation, an analyst examines NetFlow records and sees large data transfers from a server to an external IP address during off-hours. Which type of activity does this MOST likely indicate?

Accepted Answer

Data exfiltration by an attacker. Large data transfers from a server to an external IP address during off-hours are a classic indicator of data exfiltration. NetFlow records capture metadata such as source/destination IPs, ports, and byte counts; a sudden, high-volume outbound flow to an unfamiliar external IP outside normal business hours strongly suggests an attacker is copying sensitive data out of the network, not legitimate traffic.

Answer

Normal software update download

Answer

Scheduled backup to a cloud service

Answer

Denial-of-service attack against the server

Question 5

A forensic analyst needs to create a timeline of file system activity from a disk image. Which tool is specifically designed for this purpose and can parse various artifacts such as registry, prefetch, and log files?

Accepted Answer

Plaso (log2timeline). Plaso (log2timeline) is the correct tool because it is specifically designed to create super timelines of file system activity from disk images. It parses a wide range of artifacts including the Windows Registry, Prefetch files, event logs, and other log files, correlating timestamps to reconstruct a chronological sequence of system events.

Answer

Wireshark

Answer

Volatility

Answer

FTK Imager

Question 6

An incident responder examines a Linux server and finds a suspicious cron job that runs every minute and executes a script located in /tmp. Which persistence technique does this represent?

Accepted Answer

Cron-based persistence. Cron is a Linux job scheduler that executes tasks at specified intervals. A cron job running every minute from /tmp indicates an attacker has added a persistent scheduled task to maintain access, which is a classic example of cron-based persistence. This technique leverages the cron daemon (crond) to re-execute malicious code automatically, ensuring the attacker's foothold survives reboots.

Answer

Kernel rootkit

Answer

Web shell

Answer

SSH key backdoor

Question 7

Which THREE of the following are common indicators of a web shell presence on a compromised IIS web server? (Select THREE.)

Accepted Answer

Process w3wp.exe making outbound connections to an unknown IP. Option B is correct because w3wp.exe is the IIS worker process that normally serves web content and should not initiate outbound network connections; seeing it connect to an unknown external IP is a strong indicator that a web shell is being used for command-and-control or data exfiltration. Option C is correct because attackers commonly establish persistence alongside a web shell by creating scheduled tasks that invoke cmd.exe or powershell.exe, which is abnormal for a standard IIS server. Option D is correct because web shells are typically dropped as .asp or .aspx files in the wwwroot directory so they can be executed by IIS, and unexpected files with those extensions in that location are a classic compromise artifact. Option A is not a reliable indicator because increased 404 errors simply reflect missing resources or scanning noise and do not by themselves indicate a web shell. Option E is not an indicator because normal GET requests for static .html pages are ordinary benign web traffic.

Answer

Increased 404 errors in HTTP logs

Answer

Normal GET requests to static .html pages

Question 8

A security analyst reviews Windows Security Event Log and finds multiple Event ID 4625 entries for a single user account within a few seconds. What does this pattern MOST likely indicate?

Accepted Answer

Brute-force password attack. Event ID 4625 is a Windows Security log event that records failed logon attempts. When multiple 4625 events appear for the same user account within a few seconds, it indicates a high volume of authentication failures in a short time window, which is the classic signature of a brute-force password attack. The rapid succession of failures rules out accidental mistypes and points to an automated or manual attempt to guess the password.

Answer

Service installation

Answer

Account creation

Answer

Successful logon by the user

Question 9

A Linux system administrator notices that the /var/log/auth.log file shows many 'Failed password for root' entries from a single IP address within a short timeframe. Which tool would BEST help the administrator block further access from that IP?

Accepted Answer

iptables. B (iptables) is correct because it is a Linux firewall utility that can create rules to drop or reject incoming packets from a specific IP address. By adding a rule such as `iptables -A INPUT -s <IP> -j DROP`, the administrator can immediately block all further traffic from that IP, preventing additional brute-force attempts.

Answer

nmap

Answer

tcpdump

Answer

Wireshark

Question 10

A forensic analyst is performing timeline analysis on a compromised system. Which tool is specifically designed to parse multiple log sources and create a super timeline?

Accepted Answer

log2timeline. log2timeline (now part of the plaso framework) is specifically designed to parse multiple log sources—such as Windows Event Logs, syslog, web server logs, and file system metadata—and aggregate them into a single super timeline. This enables forensic analysts to correlate events across disparate logs for timeline analysis, which is exactly the requirement in the question.

Answer

Sleuth Kit

Answer

Volatility

Answer

Wireshark

Question 11

A Windows system is suspected of having malware that maintains persistence by starting every time a user logs in. Which registry key should be examined FIRST for this persistence mechanism?

Accepted Answer

Run keys. The Run keys (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) are the most common and straightforward persistence mechanism for malware that executes on user login. These registry keys specify programs that automatically run when a user logs into their account, making them the first place to check for such persistence.

Answer

ShellBags

Answer

NTUSER.DAT

Answer

HKLM\SAM

Question 12

A security analyst reviews firewall logs and sees repeated outbound connections from an internal server to an external IP on port 443. The server is not supposed to initiate outbound connections. Which action should the analyst take FIRST?

Accepted Answer

Investigate the server for signs of compromise. The server is exhibiting anomalous behavior by initiating outbound connections on port 443 (HTTPS) when it should not be doing so. This is a classic indicator of a potential compromise, such as a command-and-control (C2) callback or data exfiltration. The first priority is to investigate the server for signs of compromise to understand the scope and nature of the threat before taking any disruptive action.

Answer

Block the external IP at the firewall

Answer

Ignore the traffic as it is encrypted

Answer

Disable the server's network connection

Question 13

In Linux forensics, which file contains user account information including the user ID, group ID, home directory, and default shell?

Accepted Answer

/etc/passwd. The /etc/passwd file is the standard Linux user database that stores essential account details, including the username, user ID (UID), group ID (GID), home directory path, and default shell. Each line in this file corresponds to a user account and uses a colon-delimited format (e.g., username:x:UID:GID:comment:home:shell). This file is world-readable because it does not contain passwords (which are stored in /etc/shadow), making it the correct source for the information listed in the question.

Answer

/var/log/auth.log

Answer

/etc/shadow

Answer

/proc/cpuinfo

Question 14

During a forensic analysis of a Linux system, the investigator finds that the bash_history file is empty for the root user. However, the system has been used actively. What is the MOST likely explanation?

Accepted Answer

The HISTSIZE environment variable is set to 0 or the history file is redirected to /dev/null. The HISTSIZE environment variable controls how many commands are retained in memory during a session. When set to 0, no commands are stored, and the history file (typically ~/.bash_history) remains empty. Alternatively, if HISTFILE is redirected to /dev/null, all history writes are discarded, explaining the empty file despite active use.

Answer

The system was shut down improperly

Answer

The file is corrupted

Answer

The user deleted the history

Question 15

A forensic analyst is examining a network packet capture for signs of data exfiltration. Which THREE of the following are common indicators of data exfiltration over DNS? (Select three.)

Accepted Answer

DNS responses with unusually large payloads (e.g., TXT records). Option C is correct because DNS tunneling tools such as iodine and dnscat2 encode stolen data in TXT, NULL, or CNAME records, producing responses far larger than the typical 512-byte UDP DNS limit and thus a strong exfiltration indicator. Option D is correct because exfiltration over DNS requires many queries to carry data out, so a high volume of queries to a single domain (often thousands per hour) stands out against normal resolver traffic. Option E is correct because the encoded payload is placed in the leftmost label, generating long, random-looking subdomains such as 'aGVsbG8.evil.com' that are characteristic of DNS tunneling. Option A is not a reliable indicator: low TTLs are common in fast-flux and load-balancing setups and are not specific to exfiltration. Option B is also not specific, since clients legitimately query multiple configured or fallback DNS servers during normal resolution.

Answer

Low TTL values in DNS responses

Answer

DNS queries sent to multiple different DNS servers