CHFI OS and Network Forensics Practice Test 2 — 15 Questions

Question 1

A security analyst reviews Windows Security Event Logs and finds multiple Event ID 4625 entries from a single source IP address targeting various usernames. Which type of attack is MOST likely occurring?

Accepted Answer

Password spraying attack. Event ID 4625 indicates a failed logon attempt. Multiple failed attempts from one source against different usernames is characteristic of a password spraying attack, where an attacker tries a few common passwords across many accounts.

Answer

Brute-force attack on a single account

Answer

Pass-the-hash attack

Answer

Kerberoasting attack

Question 2

During a forensic investigation of a compromised Linux server, you find the following entry in /var/log/auth.log: 'Mar 10 03:14:15 server sshd[1234]: Accepted publickey for root from 10.0.0.5 port 54321 ssh2: RSA SHA256:AbCdEf123456'. Which artifact should you examine next to determine if unauthorized key-based access occurred?

Accepted Answer

~/.ssh/authorized_keys. The log shows acceptance of a public key. To determine if the key was unauthorized, you must examine the authorized_keys file for root (~/.ssh/authorized_keys) to see if the key was added maliciously.

Answer

/var/log/syslog

Answer

/etc/ssh/sshd_config

Answer

/etc/passwd

Question 3

Which Windows artifact is primarily used to determine the execution history of applications, including the path and run count?

Accepted Answer

Prefetch files. Prefetch files (.pf) store information about recently executed applications, including execution count and timestamps. They are located in C:\Windows\Prefetch.

Answer

LNK files

Answer

Jump lists

Answer

Event logs

Question 4

A forensic analyst discovers an unusual entry in the Windows Registry under 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run'. Which persistence mechanism does this represent?

Accepted Answer

Registry Run key persistence. The Run key is a standard location for programs to auto-start when a user logs on. A malicious entry here indicates persistence via registry run keys.

Answer

Service installation

Answer

Scheduled task

Answer

Startup folder

Question 5

In a macOS forensic investigation, which log system provides a timeline of high-level system events such as application launches and user logins?

Accepted Answer

FSEvents. FSEvents is a macOS logging system that records changes to the file system, including application launches and user logins, providing a timeline of system activity.

Answer

syslog

Answer

.plist files

Answer

Unified logging

Question 6

A network forensic analyst examines a pcap file in Wireshark and sees an HTTP POST request to '/shell.jsp' with a parameter 'cmd' containing 'dir'. The response contains a directory listing. Which intrusion artifact is indicated?

Accepted Answer

Webshell. A webshell is a malicious script that provides remote command execution via web requests. The POST to a JSP file with a cmd parameter and directory listing in the response indicates a webshell.

Answer

SQL injection

Answer

Directory traversal

Answer

Cross-site scripting (XSS)

Question 7

During a Linux forensic investigation, you find a suspicious cron job in /etc/cron.d/malware that runs every 5 minutes as root. Which persistence mechanism is being used?

Accepted Answer

Cron job. Cron jobs are a common Linux persistence mechanism. Entries in /etc/cron.d/ are system-wide cron jobs that execute at scheduled intervals.

Answer

Bash history

Answer

Systemd service

Answer

Init script

Question 8

Which tool is commonly used for timeline analysis in digital forensics, combining multiple artifacts into a super timeline?

Accepted Answer

Plaso. Plaso (log2timeline) is a tool that parses various log files and artifacts to create a super timeline for forensic analysis.

Answer

Autopsy

Answer

Sleuth Kit

Answer

Wireshark

Question 9

An analyst detects a large amount of data being exfiltrated from a network over DNS queries. Which type of network analysis would BEST detect this activity?

Accepted Answer

Packet capture analysis. DNS tunneling uses DNS queries to exfiltrate data. NetFlow analysis can identify unusual DNS traffic patterns, such as large or frequent queries to a domain, while packet capture can reveal the content.

Answer

Proxy log analysis

Answer

Firewall log analysis

Answer

IDS/IPS log analysis

Question 10

A Windows system's registry key 'HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR' contains a subkey with a serial number. What does this artifact indicate?

Accepted Answer

A USB storage device was attached. The USBSTOR registry key records the serial numbers of USB storage devices that have been connected to the system. Its presence indicates a USB device was attached.

Answer

A USB network adapter was attached

Answer

A USB printer was attached

Answer

A USB keyboard was attached

Question 11

A forensic analyst finds a file with the .plist extension on a Mac system. What type of artifact is this?

Accepted Answer

Property list file. .plist (Property List) files store configuration data for applications and system settings on macOS. They can contain user preferences, recent items, and other forensic artifacts.

Answer

Log file

Answer

Executable binary

Answer

Email database

Question 12

During a forensic analysis of a compromised Linux system, you notice that the /proc filesystem contains a suspicious entry /proc/12345/exe pointing to /tmp/.hidden/malware. What conclusion can you draw?

Accepted Answer

A process with PID 12345 is running the malware. /proc/[pid]/exe is a symbolic link to the executable of a running process. The entry indicates a process with PID 12345 is running from a hidden file in /tmp, strongly suggesting malware execution.

Answer

The system was rebooted recently

Answer

The malware is a kernel module

Answer

The malware was executed via a cron job

Question 13

Which TWO Windows Event IDs are associated with successful logon or explicit credential usage? (Choose TWO.)

Accepted Answer

4648. 4624 is a successful logon event. 4648 indicates a logon using explicit credentials (e.g., RunAs). 4625 is failed logon, 4720 is account creation, 7045 is service install.

Answer

4720

Answer

4625

Answer

7045

Question 14

Which THREE of the following are commonly used for persistence on a Windows system? (Choose THREE.)

Accepted Answer

Registry Run keys. Registry Run keys, scheduled tasks, and service installations are common persistence mechanisms. Prefetch files and LNK files are forensic artifacts but not persistence mechanisms.

Answer

LNK files

Answer

Prefetch files

Question 15

Which TWO Linux log files are MOST relevant for investigating authentication events and user login activity? (Choose TWO.)

Accepted Answer

/var/log/auth.log. /var/log/auth.log records authentication attempts (login, sudo, SSH). /var/log/syslog contains general system logs including some auth messages. /var/log/kern.log is for kernel messages, /var/log/boot.log for boot, and /var/log/dmesg for kernel ring buffer.

Answer

/var/log/boot.log

Answer

/var/log/dmesg

Answer

/var/log/kern.log