CHFI OS and Network Forensics Practice Test 14 — 15 Questions

Question 1

Which tool is commonly used in timeline analysis for digital forensics to parse various artifacts and create a super timeline?

Accepted Answer

log2timeline / Plaso. log2timeline (now part of the Plaso framework) is specifically designed to parse a wide variety of digital forensic artifacts—such as Windows Event Logs, Prefetch files, registry hives, and browser history—and aggregate them into a single, unified super timeline. This super timeline allows investigators to correlate events across different data sources and identify sequences of activity with precise timestamps, which is essential for timeline analysis in OS and network forensics.

Answer

Volatility

Answer

Wireshark

Answer

Sleuth Kit

Question 2

A forensic analyst is investigating a Windows system for evidence of USB device usage. Which registry key is MOST useful for determining the first time a USB device was connected and its serial number?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum stores a subkey for each USB mass storage device that has ever been connected to the system. Each subkey is named with the device's serial number, and its creation timestamp reflects the first time the device was enumerated (i.e., first connected). This makes it the definitive source for both the serial number and the initial connection time of a USB device.

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellBags

Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USB

Question 3

A security analyst is reviewing firewall logs and notices repeated connection attempts from an internal IP to an external server on TCP port 4444. The internal host is a web server. What is the MOST likely explanation?

Accepted Answer

The web server has a reverse shell connection to a command-and-control server. Repeated outbound connections from an internal web server to an external server on TCP port 4444 strongly indicate a reverse shell, which is a common technique used by malware to establish command-and-control (C2) communication. Unlike a standard client-server model, the internal host initiates the connection to bypass firewalls that block inbound traffic, and port 4444 is frequently associated with Metasploit's default reverse shell payload (e.g., meterpreter). This behavior is anomalous for a web server, which typically serves HTTP/HTTPS on ports 80/443 and does not initiate persistent outbound connections to arbitrary external IPs on non-standard ports.

Answer

The web server is serving HTTPS traffic on port 4444

Answer

The web server is performing DNS queries

Answer

The web server is being scanned for open ports

Question 4

A forensic analyst is investigating a Windows system for evidence of malware persistence. Which TWO registry locations are commonly used by malware to automatically execute on system startup?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Services. D is correct because the HKLM\SYSTEM\CurrentControlSet\Services registry key stores configuration for Windows services, including the ImagePath value that specifies the executable to run. Malware often installs as a service to achieve automatic execution at system startup, as services are started by the Service Control Manager (SCM) during boot, independent of user logon.

Answer

HKLM\SAM

Answer

C:\Windows\Prefetch

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellBags

Question 5

A security analyst detects a sudden spike in failed logon events with Event ID 4625 on a Windows domain controller. The source IP addresses are random and from various external subnets. Which type of attack is MOST likely occurring?

Accepted Answer

Brute‑force attack. Event ID 4625 indicates a failed logon attempt. A sudden spike from random, external source IPs is characteristic of a brute-force attack, where an attacker systematically tries many username/password combinations against the domain controller. This pattern does not match the stealthier or more targeted nature of the other attack types.

Answer

Pass‑the‑hash attack

Answer

Kerberos ticket forgery (Golden Ticket)

Answer

Insider threat with compromised credentials

Question 6

A security analyst reviews Windows Security Event Log and observes Event ID 4625 repeatedly for a single user account from a remote IP address within a short timeframe. What is the MOST likely cause?

Accepted Answer

A brute-force password attack is occurring against that account. Event ID 4625 indicates a failed logon attempt. When this event is logged repeatedly for the same user account from a single remote IP address within a short timeframe, it is a classic indicator of an automated brute-force password attack, where an attacker tries many passwords against that account in rapid succession.

Answer

The user successfully logged on from a remote workstation

Answer

The user's account was created

Answer

A service was installed on the system

Question 7

During a forensic investigation of a compromised Linux server, an analyst checks /var/log/auth.log and finds multiple entries like "Failed password for root from 10.0.0.5 port 22 ssh2". Which tool is BEST suited to analyze the timeline of these events?

Accepted Answer

log2timeline. C is correct because log2timeline (part of the Plaso framework) is specifically designed to parse multiple log sources, including /var/log/auth.log, and create a super timeline that correlates events by timestamp. This allows the analyst to reconstruct the exact sequence of failed SSH login attempts from 10.0.0.5, which is essential for timeline analysis in forensic investigations.

Answer

Nmap

Answer

Wireshark

Answer

Autopsy

Question 8

A forensic examiner recovers a Windows 10 system and finds a prefetch file for powershell.exe with a last run time of 3 days ago, but the system's security logs show no interactive logons from that user. What does this discrepancy suggest?

Accepted Answer

PowerShell was executed as part of a scheduled task or service. A is correct because PowerShell.exe can be executed by non-interactive processes such as scheduled tasks or services, which do not generate interactive logon events (Event ID 4624) in the Security log. The prefetch file records the last run time regardless of the execution context, so a discrepancy between the prefetch timestamp and the absence of interactive logons indicates that PowerShell was launched by a system-level or automated mechanism, not by a user logging on interactively.

Answer

The prefetch file is corrupted

Answer

The user deleted their profile

Answer

The system clock was changed

Question 9

Which Linux log file is the PRIMARY source for authentication-related events such as user logins, sudo usage, and failed authentication attempts?

Accepted Answer

/var/log/auth.log. /var/log/auth.log is the primary log file on Linux systems (especially Debian/Ubuntu) that records authentication-related events, including user logins (via sshd, login, su), sudo command executions, and failed authentication attempts. This log is generated by the authpriv facility in syslog and is specifically designed to capture security and authentication messages, making it the go-to source for forensic analysis of user access and privilege escalation.

Answer

/var/log/kern.log

Answer

/var/log/syslog

Answer

/var/log/boot.log

Question 10

A forensic analyst is performing timeline analysis on a compromised system. Which tool is specifically designed to parse multiple log sources and create a super timeline?

Accepted Answer

log2timeline. log2timeline (now part of the plaso framework) is specifically designed to parse multiple log sources—such as Windows Event Logs, syslog, web server logs, and file system metadata—and aggregate them into a single super timeline. This enables forensic analysts to correlate events across disparate logs for timeline analysis, which is exactly the requirement in the question.

Answer

Sleuth Kit

Answer

Volatility

Answer

Wireshark

Question 11

A security analyst observes multiple Event ID 4625 logon failures for a single user account within a short time frame, followed by Event ID 4624 logon success. Which attack technique is MOST likely indicated?

Accepted Answer

Brute-force or password spraying attack. Event ID 4625 indicates failed logon attempts, and Event ID 4624 indicates a successful logon. A rapid sequence of failures followed by a success for the same user account is the classic signature of a brute-force or password spraying attack, where an attacker tries multiple passwords until one works. This pattern is specific to authentication attempts against the local SAM or domain controller via NTLM or Kerberos, not to post-authentication attacks.

Answer

Kerberos golden ticket attack

Answer

SQL injection attack on the authentication database

Answer

Pass-the-hash attack

Question 12

During a forensic investigation, you find a prefetch file created at 03:15:22 UTC on the system. The corresponding executable's last modified timestamp is 02:30:00 UTC, and the system date/time shows a discrepancy of +5 minutes. What is the MOST accurate interpretation regarding the file execution time?

Accepted Answer

The program was executed at 03:10:22 UTC after adjusting for clock skew.. The prefetch file creation timestamp records the system time at execution. The system clock is +5 minutes ahead, so actual UTC at execution is 03:10:22 (03:15:22 minus 5 minutes). Option D correctly adjusts for this clock skew. Option B is wrong because it ignores the clock discrepancy, which is a known issue in forensic analysis.

Answer

The program was executed at 02:30:00 UTC.

Answer

The program was executed at 03:15:22 UTC.

Answer

Execution time cannot be determined from prefetch files alone.

Question 13

During a Windows forensic analysis, you find a suspicious LNK file in a user's Recent folder. Which of the following is NOT typically retrievable from an LNK file?

Accepted Answer

Username of the user who created the LNK file. LNK files store metadata about the target file and the system environment, but they do not record the username of the user who created the LNK file. The creation timestamp of the LNK file itself is stored, but the username is not part of the LNK file structure. Instead, the username context is inferred from the user's profile folder path where the LNK resides, not from the file's internal data.

Answer

Target file creation timestamp

Answer

Volume serial number of the target drive

Answer

Target file path

Question 14

A security analyst reviewing Windows Security Event Logs sees multiple Event ID 4625 entries for a single user account, followed by a successful Event ID 4624. The account is a domain administrator. What is the MOST likely explanation?

Accepted Answer

An attacker performed a brute-force password attack and succeeded. Event ID 4625 indicates a failed logon attempt, while Event ID 4624 indicates a successful logon. A sequence of multiple 4625 events for the same domain administrator account followed by a single 4624 event is the classic signature of a successful brute-force password attack, where an attacker systematically tries passwords until one works. The fact that the account is a domain administrator makes it a high-value target, and the pattern of failures then success is inconsistent with simple user error or misconfiguration.

Answer

The user typed their password incorrectly several times before succeeding

Answer

The system experienced a denial of service attack

Answer

A misconfigured application caused repeated logon attempts

Question 15

An investigator is analyzing a Windows 10 system suspected of malware persistence. Which registry key is commonly used by malware to achieve persistence by running a program at every user logon?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard autostart location that Windows checks at every user logon. Malware commonly writes a value here pointing to its executable path, ensuring it runs automatically each time the user logs into their account. This is a well-documented persistence mechanism in Windows forensics.

Answer

HKLM\SAM\SAM

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall