CHFI OS and Network Forensics Practice Test 14 — 15 Questions

Question 1

A security analyst reviewing Windows Security Event Logs sees multiple Event ID 4625 entries for a single user account, followed by a successful Event ID 4624. The account is a domain administrator. What is the MOST likely explanation?

Accepted Answer

An attacker performed a brute-force password attack and succeeded. This pattern indicates a successful brute-force attack where the attacker guessed the password and then logged in successfully. Event ID 4625 indicates failed logon attempts, and Event ID 4624 indicates a successful logon.

Answer

The user typed their password incorrectly several times before succeeding

Answer

The system experienced a denial of service attack

Answer

A misconfigured application caused repeated logon attempts

Question 2

During a forensic investigation of a compromised Linux server, you find the following entry in /var/log/auth.log: 'Mar 10 02:15:30 server sshd[1234]: Failed password for root from 10.0.0.5 port 54321 ssh2'. Which command would you use to extract all failed root login attempts from this log?

Accepted Answer

grep 'Failed password for root' /var/log/auth.log. The grep command can filter lines containing 'Failed password for root' from the auth.log file. The -i flag is unnecessary as the log is case-sensitive but not needed here.

Answer

awk '/Failed password for root/' /var/log/auth.log

Answer

grep 'Failed password for root' /var/log/auth.log

Answer

grep 'invalid.*root' /var/log/auth.log

Question 3

An investigator is analyzing a Windows 10 system suspected of malware persistence. Which registry key is commonly used by malware to achieve persistence by running a program at every user logon?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The Run key under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run is a common persistence mechanism that starts programs when the user logs on.

Answer

HKLM\SAM\SAM

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall

Question 4

In network forensics, which tool is specifically designed for packet capture and analysis, allowing examiners to inspect individual packets and reconstruct network conversations?

Accepted Answer

Wireshark. Wireshark is the industry-standard tool for packet capture and analysis, providing deep inspection of hundreds of protocols.

Answer

Tcpdump

Answer

Netstat

Answer

Nmap

Question 5

During a forensic examination of a Mac system, an investigator needs to recover historical record of file system events, such as file modifications and deletions. Which artifact should they examine?

Accepted Answer

FSEvents. FSEvents logs file system changes on macOS, recording events like file creation, modification, and deletion in a binary log.

Answer

.plist files

Answer

Unified logging

Answer

Syslog

Question 6

An analyst is examining a PCAP file in Wireshark and notices a series of TCP SYN packets sent to multiple ports on a single IP address, with no subsequent SYN-ACK replies. What type of network activity does this indicate?

Accepted Answer

A port scan attempting to identify open ports. Sending SYN packets to many ports without receiving SYN-ACKs indicates a port scan, likely a TCP SYN scan, to discover open ports.

Answer

A denial of service attack

Answer

A man-in-the-middle attack

Answer

A TCP handshake for normal connection establishment

Question 7

Which TWO of the following are Windows artifacts that can provide evidence of file execution, including timestamps and paths?

Accepted Answer

Prefetch files (*.pf). Prefetch files store information about recently executed programs, and LNK files (shortcuts) record execution details including timestamps and target paths.

Answer

Event ID 4720

Answer

SAM registry hive

Answer

Pagefile.sys

Question 8

Which TWO of the following registry keys are commonly used to maintain persistence on Windows systems by automatically starting programs?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The Run key under both HKCU and HKLM is a standard autorun location. The RunOnce key also starts programs but runs them once at next logon.

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Answer

HKLM\SAM\SAM\Domains\Account\Users

Answer

HKLM\System\CurrentControlSet\Services

Question 9

Which TWO of the following are common Linux log files that can be used for forensic analysis?

Accepted Answer

/var/log/syslog. /var/log/auth.log records authentication attempts, and /var/log/syslog records general system messages. Both are valuable in forensic investigations.

Answer

/etc/passwd

Answer

/etc/shadow

Answer

/proc/cpuinfo

Question 10

Which TWO of the following are forensic artifacts found on macOS systems that can help reconstruct user activity?

Accepted Answer

.plist files. Unified logging captures detailed system and user activity logs, and .plist files store application preferences and usage data. Both are valuable for reconstructing user actions.

Answer

Prefetch files (*.pf)

Answer

Registry hive files

Answer

Event ID 4624

Question 11

Which THREE of the following are indicators of a webshell compromise on a web server?

Accepted Answer

High CPU usage from web server processes. Unusual files in web directories, high CPU usage due to command execution, and unexpected outbound traffic are common signs of a webshell compromise. Log entries with 'cmd' parameter are also typical.

Answer

Regular successful logins to the server with correct credentials

Answer

Decrease in network traffic

Question 12

Which THREE of the following are Windows Event IDs that are particularly useful for investigating account logon activities?

Accepted Answer

4625 - An account failed to log on. Event ID 4624 logs successful logons, 4625 logs failed logons, and 4648 logs logon attempts using explicit credentials (e.g., RunAs). These are key for tracking authentication events.

Answer

4656 - A handle to an object was requested

Answer

7045 - A service was installed in the system

Question 13

Which THREE of the following are commonly used network forensic data sources?

Accepted Answer

NetFlow logs. Packet captures (PCAP), NetFlow logs, and IDS/IPS logs are all standard network forensic data sources that provide detail on network traffic.

Answer

Prefetch files

Answer

Windows registry hives

Question 14

Which TWO of the following are tools that can be used for timeline analysis in digital forensics?

Accepted Answer

log2timeline. log2timeline (option C) is a tool specifically designed for timeline analysis in digital forensics. It parses various log files and artifacts to create a super timeline, which is a comprehensive chronological record of system activity. This allows investigators to correlate events across multiple sources, such as file system timestamps, registry keys, and application logs.

Answer

Wireshark

Answer

Nmap

Answer

FTK Imager

Question 15

Which THREE of the following are persistence mechanisms that can be used on Linux systems?

Accepted Answer

Startup scripts in /etc/init.d. Cron jobs, startup scripts in /etc/init.d, and modifications to /etc/passwd to create backdoor accounts are all persistence techniques on Linux. SSH keys are not a persistence mechanism but rather an access method.

Answer

Prefetch files

Answer

SSH authorized keys