CHFI OS and Network Forensics Practice Test 13 — 15 Questions

Question 1

During a Linux forensic investigation, an analyst examines the file /var/log/auth.log and finds repeated entries with 'Failed password for root from 192.168.1.200 port 22 ssh2'. Which TWO conclusions can the analyst draw from this evidence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The system is experiencing a brute-force attack on SSH. Repeated 'Failed password for root' entries indicate multiple failed authentication attempts, which is the hallmark of a brute-force attack targeting the SSH service. The log specifically shows attempts against the root user, a common target in such attacks. This pattern of repeated failures without success suggests an automated or manual attempt to guess the password.

Answer

The source IP 192.168.1.200 belongs to a local subnet

Answer

The attacker attempted to exploit a vulnerability in the SSH version

Answer

An unauthorized user successfully logged in as root

Question 2

A security analyst captures network traffic and observes multiple TCP SYN packets sent to a range of IP addresses on port 445, followed by TCP RST packets after 15 seconds. Which THREE indicators suggest this is a network scan?

Accepted Answer

The packets are sent to sequential IP addresses in the same subnet. TCP SYN packets to multiple IPs on a single port indicate a port scan. The RST packets after a timeout suggest the targets did not respond, which is common in a sweep. Sequential IPs and the use of port 445 (SMB) are typical of scanning. The lack of established connections and the specific pattern confirm scanning.

Answer

The source IP is from an internal address

Answer

The payload contains exploit code for SMB vulnerability

Question 3

A forensic analyst is examining a Mac system for evidence of malicious activity. Which THREE artifacts are commonly analyzed in macOS forensics?

Accepted Answer

Unified logging. macOS forensics frequently examines unified logs (for system events), .plist files (for configuration and application data), and FSEvents (for file system change history). bash_history is not the default for macOS (zsh is default). Prefetch files are Windows-only.

Answer

Prefetch files

Answer

bash_history

Question 4

A network security analyst reviews firewall logs and identifies a high volume of outbound DNS queries to a known malicious domain from multiple internal hosts. Which THREE actions should the analyst take immediately?

Accepted Answer

Isolate the affected hosts from the network. Isolating the affected hosts from the network immediately stops the outbound DNS queries to the malicious domain, preventing further data exfiltration or command-and-control (C2) communication. This containment step is critical in incident response to limit the spread of infection and preserve the integrity of forensic evidence on the hosts.

Answer

Update antivirus signatures and run a full scan

Answer

Review DNS logs to identify other potential malicious domains

Question 5

A security analyst reviews Windows Security Event Logs and finds multiple Event ID 4625 entries from a single source IP address targeting various usernames. Which type of attack is MOST likely occurring?

Accepted Answer

Password spraying attack. Event ID 4625 indicates a failed logon attempt. When multiple usernames are targeted from a single source IP, it suggests the attacker is trying a small set of common passwords against many accounts to avoid account lockout thresholds. This is the hallmark of a password spraying attack, which differs from a brute-force attack that focuses on many passwords for one account.

Answer

Brute-force attack on a single account

Answer

Pass-the-hash attack

Answer

Kerberoasting attack

Question 6

In a macOS forensic investigation, which log system provides a timeline of high-level system events such as application launches and user logins?

Accepted Answer

Unified logging. Unified logging is the correct answer because it is the comprehensive logging system in macOS that captures high-level system events such as application launches and user logins, providing a timeline for forensic analysis. FSEvents, on the other hand, only records file system changes at the directory level.

Answer

syslog

Answer

FSEvents

Answer

.plist files

Question 7

Which TWO Windows Event IDs are associated with successful logon or explicit credential usage? (Choose TWO.)

Accepted Answer

4648. Event ID 4648 is logged when a user attempts to log on using explicit credentials, such as running a program as a different user or using the 'runas' command. Event ID 4624 is logged for every successful local or remote logon session, including interactive, network, and service logons. Both are standard Windows Security log events used in forensic analysis to track authentication activity.

Answer

4720

Answer

4625

Answer

7045

Question 8

In network forensics, an analyst captures traffic and sees a large number of ICMP echo requests from 10.0.0.1 to 10.0.0.2 with varying payload sizes. What is the most likely scenario?

Accepted Answer

A DoS attack using ICMP floods. The scenario describes a single source sending a large number of ICMP echo requests to a single destination with varying payload sizes. This is characteristic of an ICMP flood attack, a type of DoS attack where the attacker overwhelms the target with echo requests, consuming bandwidth and processing resources. The varying payload sizes may be an attempt to evade simple packet filters or to maximize resource consumption. In contrast, a ping sweep would involve sending requests to multiple destinations to discover live hosts, not a sustained high-volume stream to one host. Therefore, this is most likely a DoS attack, not reconnaissance.

Answer

Network reconnaissance (ping sweep)

Answer

A man-in-the-middle attack

Answer

A DNS amplification attack

Question 9

Which TWO of the following are valid artifacts for determining program execution on a Windows system? (Select TWO.)

Accepted Answer

Jump Lists. Jump Lists (C) are correct because they store recently accessed files and applications per user, providing a timeline of program execution. Prefetch files (D) are correct because they contain execution counts, timestamps, and file paths for applications launched on Windows, directly indicating program execution.

Answer

Pagefile.sys

Answer

System Restore points

Answer

Windows Error Reporting logs

Question 10

A network forensics analyst captures traffic and sees a series of TCP SYN packets sent to multiple ports on a target, with no corresponding SYN-ACK replies. What type of activity is MOST likely indicated?

Accepted Answer

A port scan reconnaissance. The observation of TCP SYN packets sent to multiple ports without any SYN-ACK replies indicates a port scan, specifically a SYN scan (half-open scan). In a SYN scan, the attacker sends a SYN packet to each port; if the port is open, the target responds with a SYN-ACK, but the attacker never completes the handshake. The absence of any SYN-ACK replies suggests that either all scanned ports are closed (RST responses would be expected) or the target is filtering traffic, but the pattern of multiple SYN packets to different ports is the hallmark of reconnaissance, not a denial-of-service attack.

Answer

A denial-of-service (DoS) flood

Answer

A man-in-the-middle attack

Answer

Normal web browsing traffic

Question 11

A forensic analyst is investigating a Windows system for persistence mechanisms. Which TWO registry locations are commonly used by malware to achieve auto-start? (Select TWO.)

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard auto-start location where malware can add entries to execute programs when a user logs in. This key is commonly abused because it does not require administrative privileges to modify, making it a frequent persistence mechanism for user-level malware.

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKLM\SAM\SAM

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Question 12

Which tool is commonly used for timeline analysis in digital forensics, allowing examiners to parse and correlate timestamps from various artifacts?

Accepted Answer

log2timeline. log2timeline (now part of the Plaso framework) is the de facto tool for timeline analysis in digital forensics. It parses a wide range of artifacts (e.g., $MFT, $UsnJrnl, Prefetch, Registry hives, event logs) and correlates their timestamps into a unified, super-timeline, enabling examiners to reconstruct system activity chronologically.

Answer

Sleuth Kit

Answer

Nmap

Answer

Wireshark

Question 13

A forensic investigator is examining a Mac system and wants to review recently accessed files and applications. Which macOS artifact is MOST useful for this purpose?

Accepted Answer

FSEvents (/.fseventsd). FSEvents (/.fseventsd) is the correct choice because it maintains a persistent, chronological record of file system changes on macOS, including file accesses and modifications. This artifact allows an investigator to reconstruct a timeline of recently accessed files and applications, as the FSEvents daemon logs events such as file opens, renames, and deletions at the volume level, making it the most direct source for this purpose.

Answer

bash_history

Answer

.plist files in ~/Library/Preferences/

Answer

Unified Logging (log stream)

Question 14

During a network forensic investigation, the analyst examines firewall logs and notices a large number of outbound connections from an internal server to various IP addresses on port 443 at regular intervals. The connections are all initiated by a process called 'svchost.exe' running from a non-standard location (C:\Windows\Temp). What is the MOST likely explanation?

Accepted Answer

The server is infected with malware that is beaconing to a command-and-control server. Svchost.exe running from C:\Windows\Temp is a classic sign of malware masquerading as a legitimate Windows process. The regular outbound connections on port 443 (HTTPS) at fixed intervals indicate beaconing behavior, where the infected host periodically contacts a command-and-control (C2) server to receive instructions or exfiltrate data. Legitimate svchost.exe resides in C:\Windows\System32, and any deviation from this path is a strong indicator of compromise.

Answer

The server is running a scheduled backup to an external cloud service

Answer

The server is performing legitimate Windows Update checks

Answer

The server is being used as a proxy for internal users

Question 15

Which Windows artifact is specifically designed to track the most recently used (MRU) files for specific applications and can be found in the NTUSER.DAT registry hive?

Accepted Answer

MRU lists in the registry. The NTUSER.DAT registry hive contains per-user MRU (Most Recently Used) lists that track files recently accessed by specific applications, such as the 'RecentDocs' key for Office applications or 'ComDlg32' for common dialog boxes. These registry keys are explicitly designed to store MRU data, making them the direct artifact for this purpose.

Answer

Prefetch files

Answer

Jump Lists

Answer

LNK files