CHFI OS and Network Forensics Practice Test 12 — 15 Questions

Question 1

A forensic examiner uses Plaso (log2timeline) to create a timeline from a disk image. Which of the following artifacts would NOT be included in the timeline by default using the 'all' parser?

Accepted Answer

Chrome browser history. The 'all' parser set in Plaso includes most common forensic artifacts, but it deliberately excludes browser history artifacts such as Chrome history to reduce processing time and data volume. The SAM registry hive, Event Logs, and Prefetch files are all included by default.

Answer

Event Log entries (evtx)

Answer

Registry SAM hive entries

Answer

Windows Prefetch files

Question 2

In a Windows forensic investigation, which registry key is used to examine programs that automatically start at system boot for all users?

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run registry key stores programs that automatically start at system boot for all users. This is a system-wide location, meaning any executable listed here runs regardless of which user logs in, making it critical for forensic analysis of persistent malware or unauthorized startup applications.

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Answer

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run

Question 3

Which network forensic tool is BEST suited for analyzing NetFlow data to identify top talkers and detect anomalies?

Accepted Answer

SiLK. SiLK (System for Internet-Level Knowledge) is specifically designed for large-scale NetFlow data analysis, providing tools to aggregate flow records, identify top talkers (e.g., using rwtop or rwstats), and detect anomalies through statistical baselines. Unlike packet-level tools, SiLK works directly with flow summaries, making it efficient for high-volume network traffic analysis in forensic investigations.

Answer

tcpdump

Answer

Nmap

Answer

Wireshark

Question 4

A forensic analyst is investigating a Windows system and wants to identify recently executed programs. Which TWO artifacts should the analyst examine?

Accepted Answer

Prefetch files. Prefetch files (B) are created by Windows to speed up application startup and contain the last eight execution times, making them a primary artifact for identifying recently executed programs. UserAssist (C) logs GUI-based application launches in the NTUSER.DAT registry hive under 'Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist', recording execution counts and timestamps. Both artifacts provide direct evidence of program execution, unlike other options that track folder views or file access patterns.

Answer

MRU lists

Answer

ShellBags

Answer

Jump lists

Question 5

A security analyst detects suspicious outbound traffic to multiple external IPs on port 443. Which THREE network forensic data sources should be examined to identify the infected host and the nature of the communication?

Accepted Answer

Proxy logs. Firewall logs, proxy logs, and IDS/IPS logs are essential: firewall logs show allowed/denied connections, proxy logs reveal HTTP/HTTPS traffic details, and IDS/IPS logs detect malicious payloads.

Answer

Packet captures (PCAP)

Answer

NetFlow data

Question 6

During a macOS forensic investigation, which TWO artifacts would be MOST helpful in determining when a file was downloaded from the internet?

Accepted Answer

Quarantine database. The Quarantine database (C) is correct because macOS tracks downloaded files by recording metadata such as the download URL, timestamp, and application used in a SQLite database located at ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2. This database is the primary artifact for determining when a file was downloaded from the internet, as it is populated automatically by the system's quarantine system (kLSQuarantineDataURLSchemeKey).

Answer

Kernel logs

Answer

.plist files in ~/Library/Preferences

Answer

FSEvents

Question 7

During a forensic investigation of a compromised Linux server, you find the following entry in /var/log/auth.log: 'Mar 10 02:15:30 server sshd[1234]: Failed password for root from 10.0.0.5 port 54321 ssh2'. Which command would you use to extract all failed root login attempts from this log?

Accepted Answer

awk '/Failed password for root/' /var/log/auth.log. Both `awk '/Failed password for root/' /var/log/auth.log` and `grep 'Failed password for root' /var/log/auth.log` will extract all lines containing 'Failed password for root' from the auth.log file. The awk command prints every line matching the given regex, and grep does the same. Therefore, both A and B are correct. If the exam intends a single best answer, it needs clarification (e.g., asking for the 'most common' or 'simplest' command), but as written, both are valid.

Answer

grep 'Failed password for root' /var/log/secure

Answer

grep 'invalid.*root' /var/log/auth.log

Question 8

In network forensics, which tool is specifically designed for packet capture and analysis, allowing examiners to inspect individual packets and reconstruct network conversations?

Accepted Answer

Wireshark. Wireshark is the correct answer because it is a full-featured packet analyzer that captures live network traffic and provides deep inspection of hundreds of protocols. It allows examiners to filter packets, follow TCP streams, and reconstruct entire network conversations, making it the standard tool for network forensics analysis.

Answer

Tcpdump

Answer

Netstat

Answer

Nmap

Question 9

An analyst is examining a PCAP file in Wireshark and notices a series of TCP SYN packets sent to multiple ports on a single IP address, with no subsequent SYN-ACK replies. What type of network activity does this indicate?

Accepted Answer

A port scan attempting to identify open ports. Sending SYN packets to many ports without receiving SYN-ACKs indicates a port scan, likely a TCP SYN scan, to discover open ports.

Answer

A denial of service attack

Answer

A man-in-the-middle attack

Answer

A TCP handshake for normal connection establishment

Question 10

Which TWO of the following are Windows artifacts that can provide evidence of file execution, including timestamps and paths?

Accepted Answer

Prefetch files (*.pf). Prefetch files (*.pf) are created by Windows to speed up application startup; they record the first time an application is executed, the full path to the executable, and the number of times it has been run. LNK files (shortcuts) are created when a user or the system accesses a file or application, storing the target path, creation timestamp, and last access timestamp, making both artifacts critical for proving file execution.

Answer

Event ID 4720

Answer

SAM registry hive

Answer

Pagefile.sys

Question 11

Which TWO of the following registry keys are commonly used to maintain persistence on Windows systems by automatically starting programs?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard autostart location that specifies programs to run automatically when a user logs in. This key is commonly exploited by malware to maintain persistence on Windows systems, as it executes the listed programs without user interaction.

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Answer

HKLM\SAM\SAM\Domains\Account\Users

Answer

HKLM\System\CurrentControlSet\Services

Question 12

Which TWO of the following are common Linux log files that can be used for forensic analysis?

Accepted Answer

/var/log/syslog. The /var/log/syslog file is a central log file on many Linux distributions (e.g., Debian-based systems) that records a wide range of system activity, including kernel messages, service starts/stops, and authentication events. Forensic analysts examine this file to reconstruct timelines of system events, identify unauthorized access attempts, and detect anomalous behavior.

Answer

/etc/passwd

Answer

/etc/shadow

Answer

/proc/cpuinfo

Question 13

Which TWO of the following are forensic artifacts found on macOS systems that can help reconstruct user activity?

Accepted Answer

.plist files. A is correct because .plist files (property lists) on macOS store application preferences, user settings, and system configuration data in XML or binary format. Forensic analysis of .plist files can reveal user activity such as recently opened files, application usage history, and network share connections, making them a key artifact for reconstructing user actions.

Answer

Prefetch files (*.pf)

Answer

Registry hive files

Answer

Event ID 4624

Question 14

Which THREE of the following are Windows Event IDs that are particularly useful for investigating account logon activities?

Accepted Answer

4625 - An account failed to log on. Event ID 4625 is generated by the Windows Security Log when an account fails to log on, capturing details such as the account name, source IP address, and logon type. This event is critical for identifying brute-force attacks, password guessing, or unauthorized access attempts against a system.

Answer

4656 - A handle to an object was requested

Answer

7045 - A service was installed in the system

Question 15

Which THREE of the following are commonly used network forensic data sources?

Accepted Answer

NetFlow logs. NetFlow logs are a standard network forensic data source because they provide summarized metadata about IP traffic flows, including source/destination IPs, ports, protocols, and timestamps, as defined in RFC 3954. This allows investigators to reconstruct communication patterns and identify anomalies without storing full packet payloads, making it efficient for long-term retention and analysis of network activity.

Answer

Prefetch files

Answer

Windows registry hives