CHFI OS and Network Forensics Practice Test 13 — 15 Questions

Question 1

In a Mac forensic investigation, which TWO artifacts are valuable for determining the timeline of file access? (Select two.)

Accepted Answer

Unified logging. Unified logging (C) is correct because macOS's unified logging system (introduced in 10.12) stores system and application activity in .tracev3 files under /var/db/diagnostics, and its timestamps can establish when processes ran or files were touched, supporting timeline reconstruction. FSEvents (E) is correct because the FSEvents database (.fseventsd) records directory-level filesystem change events with timestamps, which is a core artifact for building a macOS file-access timeline. ShellBags (A) and NTUSER.DAT (D) are Windows artifacts (registry-based folder view settings and per-user registry hive, respectively) and do not exist on macOS. Prefetch files (B) are also a Windows artifact (C:\Windows\Prefetch) used for program execution analysis, not macOS file-access timelines.

Answer

ShellBags

Answer

Prefetch files

Answer

NTUSER.DAT

Question 2

A security analyst observes multiple Event ID 4625 logon failures for a single user account within a short time frame, followed by Event ID 4624 logon success. Which attack technique is MOST likely indicated?

Accepted Answer

Brute-force or password spraying attack. Event ID 4625 indicates failed logon attempts, and Event ID 4624 indicates a successful logon. A rapid sequence of failures followed by a success for the same user account is the classic signature of a brute-force or password spraying attack, where an attacker tries multiple passwords until one works. This pattern is specific to authentication attempts against the local SAM or domain controller via NTLM or Kerberos, not to post-authentication attacks.

Answer

Kerberos golden ticket attack

Answer

SQL injection attack on the authentication database

Answer

Pass-the-hash attack

Question 3

During a forensic investigation, you find a prefetch file created at 03:15:22 UTC on the system. The corresponding executable's last modified timestamp is 02:30:00 UTC, and the system date/time shows a discrepancy of +5 minutes. What is the MOST accurate interpretation regarding the file execution time?

Accepted Answer

The program was executed at 03:10:22 UTC after adjusting for clock skew.. The prefetch file creation timestamp records the system time at execution. The system clock is +5 minutes ahead, so actual UTC at execution is 03:10:22 (03:15:22 minus 5 minutes). Option D correctly adjusts for this clock skew. Option B is wrong because it ignores the clock discrepancy, which is a known issue in forensic analysis.

Answer

The program was executed at 02:30:00 UTC.

Answer

The program was executed at 03:15:22 UTC.

Answer

Execution time cannot be determined from prefetch files alone.

Question 4

Which Windows registry hive stores user-specific configuration and is loaded when a user logs in, containing artifacts such as recently accessed files and application settings?

Accepted Answer

NTUSER.DAT. NTUSER.DAT is the registry hive that contains user-specific settings and is loaded into HKEY_CURRENT_USER upon logon. It includes UserAssist, MRU lists, and other user activity artifacts.

Answer

SECURITY

Answer

HKLM\SAM

Answer

SYSTEM

Question 5

Which tool is specifically designed for timeline analysis of forensic artifacts across multiple systems and can process output from various forensic tools?

Accepted Answer

log2timeline. log2timeline (now part of the Plaso framework) is specifically designed for super timeline creation, aggregating and correlating timestamps from multiple forensic artifacts across different systems. It can ingest output from tools like The Sleuth Kit, Autopsy, and others to produce a unified, high-resolution timeline for analysis.

Answer

Autopsy

Answer

Wireshark

Answer

Sleuth Kit

Question 6

A forensics examiner finds a suspicious entry in the Windows Registry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to a PowerShell command. Which persistence mechanism does this represent, and what is the MOST likely impact?

Accepted Answer

Registry run key persistence; the command executes each time the user logs in.. The HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard Windows Run key that automatically executes programs when the user logs in. A PowerShell command placed here will run with the user's privileges at each interactive logon, establishing persistence without requiring elevated privileges or system-level access.

Answer

Service persistence; the malware runs as a system service.

Answer

Scheduled task persistence; the command runs at a scheduled time.

Answer

Bootkit persistence; the malware loads before the OS.

Question 7

In Mac forensics, which artifact stores system-wide and per-user application preferences, often used to determine configured settings and recently accessed files?

Accepted Answer

.plist files. In macOS, application and system preferences are stored in property list (.plist) files. These XML or binary files contain key-value pairs that define configured settings, default values, and recently accessed files (e.g., NSRecentDocuments). Forensic examiners parse .plist files to recover user behavior, application usage, and system configuration.

Answer

Unified logging

Answer

Sqlite databases

Answer

FSEvents

Question 8

Which Windows Event ID is generated when a new service is installed on the system?

Accepted Answer

7045. Windows Event ID 7045 is specifically logged in the System event log when a new service is installed on the system. This event records the service name, image path, service type, and start mode, making it a critical artifact for forensic investigators tracking unauthorized service installations or persistence mechanisms.

Answer

4648

Answer

4720

Answer

4624

Question 9

A forensics investigator finds a suspicious LNK file on a Windows system that points to a script located on a remote share. What is the PRIMARY forensic significance of this LNK file?

Accepted Answer

It may be part of a lateral movement technique using remote execution.. An LNK file pointing to a remote share is a classic indicator of lateral movement, often used in techniques like SMB-based remote execution or PsExec. The LNK file itself does not execute code, but when opened, it triggers the Windows shell to connect to the remote share and run the script, allowing an attacker to move from one system to another without dropping a binary on the target. This is a key forensic artifact for identifying network-based propagation in attacks such as ransomware or APT intrusions.

Answer

It is evidence of USB device insertion.

Answer

It shows the user's recently accessed files.

Answer

It is a prefetch artifact indicating the script was executed.

Question 10

Which TWO artifacts are commonly used to identify USB device insertion history on a Windows system? (Select TWO.)

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR registry key and setupapi.dev.log contain information about USB devices connected to the system, including device IDs and timestamps.

Answer

NTUSER.DAT

Answer

prefetch files

Answer

Event ID 7045

Question 11

Which THREE of the following are indicators of a webshell on a compromised web server? (Select THREE.)

Accepted Answer

Presence of system commands in web server error logs. Option B is correct because webshells typically execute operating-system commands (e.g., cmd.exe, /bin/sh, whoami, net user) that get recorded in web server error logs when the shell's input or output triggers errors, making such command strings a strong indicator of compromise. Option C is correct because attackers drop webshell files with executable web extensions such as .asp, .php, or .jsp into web-accessible directories (often with obfuscated or unusual names) so they can be invoked remotely over HTTP. Option D is correct because a webshell commonly initiates outbound connections from the web server to attacker-controlled command-and-control or exfiltration IP addresses, which is anomalous for a server that should mainly receive inbound HTTP requests. Option A is not specific to webshells, since multiple failed logins in auth.log indicate brute-force or credential attacks against SSH or other services rather than a web-based backdoor. Option E is also not specific, because high CPU usage from the web server process can result from legitimate traffic spikes, misconfiguration, or other malware, and is not a distinctive webshell indicator.

Answer

Multiple failed login attempts in auth.log

Answer

High CPU usage from the web server process

Question 12

Which TWO of the following are typical sources of evidence for network forensics? (Select TWO.)

Accepted Answer

Firewall logs. Firewall logs (C) are a canonical network-forensics source because they record connection metadata such as source/destination IP addresses, ports, protocol, timestamps, and allow/deny actions, which lets an investigator reconstruct traffic flows and identify blocked or permitted communications. Packet capture (pcap) files (E) are also a core network-forensics source because they contain the actual captured frames/packets (e.g., from tcpdump/Wireshark), enabling deep protocol-level analysis of payloads, sessions, and anomalies. The other options are host-based artifacts rather than network evidence: Windows registry hives (A) store OS and application configuration, bash_history (B) records shell commands executed by a user, and Prefetch files (D) are Windows execution artifacts showing program run times and loaded modules.

Answer

Windows registry hives

Answer

bash_history

Answer

Prefetch files

Question 13

A security analyst reviews Windows Security Event Log and notices multiple Event ID 4625 entries for a single user account from various IP addresses within a short time frame. What is the MOST likely attack being attempted?

Accepted Answer

Brute-force password attack. Event ID 4625 indicates a failed logon attempt. Multiple such events for a single user account from various IP addresses within a short time frame is the classic signature of a brute-force password attack, where an attacker tries many passwords against one account from multiple source IPs to evade rate-limiting or IP-based blocking.

Answer

Kerberos golden ticket attack

Answer

ARP spoofing attack

Answer

Pass-the-hash attack

Question 14

During a Linux forensic investigation, you find the following entry in /var/log/auth.log: "Accepted publickey for root from 203.0.113.5 port 54321 ssh2: RSA SHA256:abc...". The user claims they never connect from that IP. Which forensic artifact should you examine next to confirm unauthorized access?

Accepted Answer

~/.ssh/authorized_keys for unauthorized keys. The log entry shows a successful SSH authentication using a public key from an unknown IP. The most direct way to confirm unauthorized access is to check ~/.ssh/authorized_keys for any rogue public keys that were added without the user's knowledge, as this file controls which keys are permitted to authenticate as that user. If an attacker added their own public key here, they could log in without a password, making this the primary artifact to examine.

Answer

bash_history for suspicious commands

Answer

/etc/shadow for recent modifications

Answer

/var/log/syslog for cron job entries

Question 15

A forensic analyst examines a Mac system and runs "log show --predicate 'eventMessage contains "disk"' --last 1h" in Terminal. This command extracts Unified Log entries related to disk activity. Which macOS forensic artifact is the analyst MOST likely querying?

Accepted Answer

Apple Unified Logging. The 'log show' command with --predicate queries the Apple Unified Logging system, which centralizes logs from various subsystems.

Answer

.plist files

Answer

FSEvents

Answer

Core Storage logs