CHFI OS and Network Forensics Practice Test 2 — 15 Questions

Question 1

During a forensic investigation of a compromised Linux server, you find the following entry in /var/log/auth.log: 'Mar 10 03:14:15 server sshd[1234]: Accepted publickey for root from 10.0.0.5 port 54321 ssh2: RSA SHA256:AbCdEf123456'. Which artifact should you examine next to determine if unauthorized key-based access occurred?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

~/.ssh/authorized_keys. The log entry shows a successful public key authentication from root. To determine if this key-based access was unauthorized, you must examine the ~/.ssh/authorized_keys file for the root user. This file contains the public keys that are authorized to log in as root; if the key fingerprint SHA256:AbCdEf123456 is present, the access was legitimate; if absent, it indicates an unauthorized key was added by an attacker.

Answer

/var/log/syslog

Answer

/etc/ssh/sshd_config

Answer

/etc/passwd

Question 2

Which Windows artifact is primarily used to determine the execution history of applications, including the path and run count?

Accepted Answer

Prefetch files. Prefetch files (.pf) are created by Windows to speed up application startup by caching data about the files loaded during the first few seconds of execution. Each prefetch file records the application's path, the number of times it has been run (run count), and the last execution timestamp, making it the primary artifact for determining execution history.

Answer

LNK files

Answer

Jump lists

Answer

Event logs

Question 3

A forensic analyst discovers an unusual entry in the Windows Registry under 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run'. Which persistence mechanism does this represent?

Accepted Answer

Registry Run key persistence. The registry key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' is a standard Windows Registry Run key that automatically launches specified programs when a user logs in. This is a well-known persistence mechanism used by both legitimate software and malware to maintain foothold on a system. The presence of an unusual entry here indicates an attempt to achieve persistence via the registry.

Answer

Service installation

Answer

Scheduled task

Answer

Startup folder

Question 4

A network forensic analyst examines a pcap file in Wireshark and sees an HTTP POST request to '/shell.jsp' with a parameter 'cmd' containing 'dir'. The response contains a directory listing. Which intrusion artifact is indicated?

Accepted Answer

Webshell. The HTTP POST request to '/shell.jsp' with a 'cmd' parameter containing 'dir' and a response showing a directory listing is a classic indicator of a webshell. A webshell is a malicious script (e.g., JSP, ASP, PHP) uploaded to a web server that allows an attacker to execute arbitrary system commands via HTTP requests, effectively providing remote command execution. The presence of a command parameter and the server's response executing that command directly confirms the artifact is a webshell.

Answer

SQL injection

Answer

Directory traversal

Answer

Cross-site scripting (XSS)

Question 5

During a Linux forensic investigation, you find a suspicious cron job in /etc/cron.d/malware that runs every 5 minutes as root. Which persistence mechanism is being used?

Accepted Answer

Cron job. The cron daemon reads job definitions from files in /etc/cron.d/ and executes them according to the schedule specified. Finding a file named 'malware' in /etc/cron.d/ that runs every 5 minutes as root directly indicates a cron job persistence mechanism, as this is the standard location for system-wide cron entries.

Answer

Bash history

Answer

Systemd service

Answer

Init script

Question 6

Which tool is commonly used for timeline analysis in digital forensics, combining multiple artifacts into a super timeline?

Accepted Answer

Plaso. Plaso (log2timeline) is the correct tool for timeline analysis because it ingests multiple forensic artifacts (e.g., registry hives, event logs, file system metadata, browser history) and correlates them into a single, unified super timeline. This allows investigators to reconstruct events across different data sources in chronological order, which is essential for timeline analysis in digital forensics.

Answer

Autopsy

Answer

Sleuth Kit

Answer

Wireshark

Question 7

An analyst detects a large amount of data being exfiltrated from a network over DNS queries. Which type of network analysis would BEST detect this activity?

Accepted Answer

Packet capture analysis. Packet capture analysis (C) is the best method because DNS exfiltration involves encoding stolen data into DNS query or response fields (e.g., subdomains, TXT records). Only full packet capture allows inspection of the raw DNS payloads, including the actual query names and response data, which is necessary to detect the anomalous patterns of data being tunneled over DNS. Proxy, firewall, and IDS/IPS logs typically only record metadata (source/destination, timestamps, allowed/denied actions) and do not provide the granularity to see the encoded data within DNS packets.

Answer

Proxy log analysis

Answer

Firewall log analysis

Answer

IDS/IPS log analysis

Question 8

A Windows system's registry key 'HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR' contains a subkey with a serial number. What does this artifact indicate?

Accepted Answer

A USB storage device was attached. The registry key 'HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR' specifically enumerates USB mass storage devices (e.g., flash drives, external hard drives). The presence of a subkey with a serial number indicates that a USB storage device was attached and recognized by the Windows operating system, as the serial number uniquely identifies the device. This key is a primary artifact in USB forensics for tracking storage device connections.

Answer

A USB network adapter was attached

Answer

A USB printer was attached

Answer

A USB keyboard was attached

Question 9

A forensic analyst finds a file with the .plist extension on a Mac system. What type of artifact is this?

Accepted Answer

Property list file. The .plist extension stands for 'property list', a structured data file used by macOS and iOS applications to store serialized objects like configuration settings, user preferences, and application state. These files are XML or binary-encoded and are a key artifact in forensic analysis for recovering user activity, application usage, and system configuration. Option D is correct because .plist files are explicitly defined as property list files in Apple's developer documentation.

Answer

Log file

Answer

Executable binary

Answer

Email database

Question 10

During a forensic analysis of a compromised Linux system, you notice that the /proc filesystem contains a suspicious entry /proc/12345/exe pointing to /tmp/.hidden/malware. What conclusion can you draw?

Accepted Answer

A process with PID 12345 is running the malware. The /proc filesystem is a virtual filesystem that provides process information. The entry /proc/12345/exe is a symbolic link pointing to the executable file that started the process with PID 12345. Since this link exists and points to /tmp/.hidden/malware, it confirms that a process with PID 12345 is currently running that malware binary.

Answer

The system was rebooted recently

Answer

The malware is a kernel module

Answer

The malware was executed via a cron job

Question 11

Which THREE of the following are commonly used for persistence on a Windows system? (Choose THREE.)

Accepted Answer

Registry Run keys. Registry Run keys (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) are a standard persistence mechanism because Windows automatically executes programs listed in these keys at user logon. Attackers commonly add malicious entries here to ensure their code runs every time the user logs in, making it a frequent forensic artifact.

Answer

LNK files

Answer

Prefetch files

Question 12

Which TWO Linux log files are MOST relevant for investigating authentication events and user login activity? (Choose TWO.)

Accepted Answer

/var/log/auth.log. /var/log/auth.log is the primary log file on Debian-based Linux systems that records all authentication-related events, including user logins, sudo usage, SSH authentication attempts, and PAM module activities. This file is generated by the authpriv facility in syslog and is the go-to source for forensic investigators analyzing login activity.

Answer

/var/log/boot.log

Answer

/var/log/dmesg

Answer

/var/log/kern.log

Question 13

During a Windows forensic investigation, an analyst finds a registry key under NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count. What type of artifact is this, and what information does it typically contain?

Accepted Answer

UserAssist entries that record program execution history with counts and timestamps. The UserAssist key under NTUSER.DAT tracks GUI-based program launches via the Windows Explorer shell. It stores a Rot13-encoded or base64-encoded binary blob containing the executable path, a count of executions, and the last execution timestamp in a FILETIME format. This makes it a primary artifact for identifying user application usage history.

Answer

Jump list data from the taskbar showing recently opened files

Answer

Prefetch file metadata indicating application launch times

Answer

ShellBags data displaying folder view settings and sizes

Question 14

In Linux forensics, an investigator examines /var/log/auth.log and finds repeated entries of "Failed password for root from 10.0.0.5 port 22 ssh2". Which type of attack is most likely indicated?

Accepted Answer

Brute force attack on SSH. Repeated 'Failed password for root' entries in /var/log/auth.log indicate multiple authentication attempts against the SSH service. This pattern is characteristic of a brute force attack, where an attacker systematically tries many passwords to gain unauthorized access to the root account via SSH.

Answer

DNS cache poisoning attack

Answer

SQL injection attack

Answer

ARP spoofing attack

Question 15

A security analyst reviews the following Windows Event log entry: Event ID 4648 with logon type 3, subject user 'CONTOSO\admin', target server 'FS01', target user 'CONTOSO\backupadmin'. What does this event indicate?

Accepted Answer

An explicit credential logon was performed to access FS01 using the backupadmin account. Event ID 4648 with logon type 3 indicates a network logon where explicit credentials were supplied. The subject user 'CONTOSO\admin' attempted to access the target server 'FS01' using the target user 'CONTOSO\backupadmin' account, meaning the admin explicitly provided backupadmin's credentials for that network connection, rather than using their own.

Answer

A user account was created for backupadmin on FS01

Answer

A service was installed under the backupadmin account

Answer

The backupadmin account locked out due to multiple failed attempts