CHFI OS and Network Forensics Practice Test 2 — 15 Questions

Question 1

Which THREE of the following are common persistence mechanisms found in Linux systems? (Select three.)

Accepted Answer

SSH authorized_keys. SSH authorized_keys (B) is a common persistence mechanism because an attacker can append their own public key to a user's ~/.ssh/authorized_keys file, granting passwordless SSH access that survives reboots. Systemd services (C) are frequently abused for persistence by creating or modifying .service unit files (e.g., in /etc/systemd/system/) so malicious code runs automatically at boot or on a trigger. Cron jobs (D) provide persistence via crontab entries (user or /etc/cron.*) that schedule recurring execution of attacker payloads. The unmarked options do not qualify: .bashrc (A) is a shell startup file that only executes on interactive shell logins and is not typically classified as a core persistence mechanism in this context, and /etc/passwd modification (E) is more of a privilege/account manipulation technique than a persistence mechanism, since adding a user alone does not guarantee recurring code execution.

Answer

.bashrc in user home directories

Answer

/etc/passwd file modification

Question 2

During an incident response on a Linux server, you find the following entry in /var/log/auth.log: "Mar 10 12:34:56 server sshd[1234]: Failed password for root from 10.0.0.5 port 34567 ssh2". Which of the following is the BEST immediate action to prevent further unauthorized access?

Accepted Answer

Edit /etc/ssh/sshd_config to set PermitRootLogin no and PasswordAuthentication no, then restart sshd. It directly addresses the two most common attack vectors for SSH brute-force attacks: disabling root login (PermitRootLogin no) and disabling password-based authentication (PasswordAuthentication no) in favor of key-based authentication. This configuration change, followed by restarting sshd, immediately stops password-based attacks against root, which is the account targeted in the log entry. Blocking the IP alone (Option A) is reactive and does not prevent the same attacker from using a different IP, while changing the password (Option D) does not prevent future brute-force attempts.

Answer

Block the IP address 10.0.0.5 at the firewall

Answer

Delete the root user account

Answer

Change the root password to a complex password

Question 3

A forensic analyst is examining a Mac system for evidence of recent file access. Which artifact provides a timeline of file system events with high precision and is commonly analyzed using tools like mac_apt?

Accepted Answer

FSEvents. FSEvents (Option D) is the correct answer because it is a macOS kernel-level mechanism that logs file system events (e.g., creation, modification, deletion) with nanosecond precision. Tools like mac_apt parse the FSEventsd database to reconstruct a high-resolution timeline of user and system file activity, making it ideal for forensic timeline analysis.

Answer

bash_history

Answer

Unified Logging

Answer

.plist files

Question 4

A security analyst is analyzing network traffic and sees the following: Source IP 10.0.0.1, Destination IP 203.0.113.5, TCP SYN flag set, destination port 445. The analyst suspects a worm propagation attempt. Which TWO additional pieces of evidence would strengthen this conclusion?

Accepted Answer

The packet size is exactly 66 bytes, identical to other similar packets. Option A is correct because a fixed, unusually small packet size (66 bytes) repeated identically across many packets is a hallmark of automated worm scanning traffic, where a single crafted SYN probe is sent unchanged to thousands of targets rather than normal variable-sized application traffic. Option B is correct because a single host sending SYN packets to many internal IPs on port 445 indicates horizontal scanning of the SMB service, which is exactly how worms such as WannaCry and Conficker self-propagate across a network. The unmarked options do not belong: a source MAC from a known vendor (C) only identifies hardware and does not indicate malicious behavior, a payload containing 'SMBv2' (D) is inconsistent with a bare SYN packet that carries no application payload, and a destination being a known web server (E) is irrelevant since port 445 is SMB, not HTTP, and does not evidence worm activity.

Answer

The source MAC address is from a well-known vendor

Answer

The packet contains a payload with the string "SMBv2"

Answer

The destination IP 203.0.113.5 is a known web server

Question 5

During a forensic investigation of a Windows 10 system, an examiner finds the following registry key: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count. The values contain Rot‑13 encoded data. What is the primary purpose of this artifact?

Accepted Answer

Track programs executed by the user. The UserAssist key under NTUSER.DAT tracks GUI-based program executions via the Windows shell. The {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA} GUID corresponds to the 'Exec' subkey, which logs each executable launched by the user, with the path and count stored in Rot‑13 encoded format. This artifact is specifically designed to record program execution history, not file opens, USB devices, or network shares.

Answer

Store recently opened documents (MRU list)

Answer

Record USB device insertion history

Answer

Log network share connections

Question 6

An analyst is examining a Linux server and issues the command: cat /var/log/auth.log | grep 'Failed password' | awk '{print $1,$2,$3,$9,$11}' | sort | uniq -c. What is the analyst most likely trying to determine?

Accepted Answer

The IP addresses with the most failed SSH login attempts. The command filters /var/log/auth.log for lines containing 'Failed password', extracts the date, time, user, and source IP (fields $1, $2, $3, $9, $11), sorts them, and counts unique occurrences with uniq -c. Sorting by count reveals which IP addresses have the highest number of failed SSH login attempts, indicating a brute-force attack pattern. In CHFI, understanding log analysis is crucial for forensic investigations of unauthorized access attempts.

Answer

The list of all sudo commands executed

Answer

The number of distinct users who successfully logged in

Answer

The total number of successful logins

Question 7

Which Windows registry hive should be examined to determine the last time a specific external USB drive was connected to a system?

Accepted Answer

HKLM\SYSTEM. The HKLM\SYSTEM hive contains the `Enum\USBSTOR` and `MountPoints2` keys, which store detailed logs of every USB device that has been connected to the system, including the last connection timestamp. Specifically, the `SYSTEM\CurrentControlSet\Enum\USBSTOR` key records the device instance ID and the `Properties\{83da6326-97a6-4088-9453-a1923f573b29}` subkey holds the `LastConnected` timestamp in FILETIME format, making it the definitive source for determining the last connection time of an external USB drive.

Answer

HKLM\SAM

Answer

HKLM\SOFTWARE

Answer

HKLM\SECURITY

Question 8

A forensic analyst is investigating a macOS system and wants to review a timeline of past application launches and file accesses across multiple days. Which forensic artifact is BEST suited for this purpose?

Accepted Answer

Unified logging (log show). Unified logging (log show) on macOS aggregates system-wide events, including application launches and file accesses, with timestamps across multiple days. It provides a comprehensive timeline via the `log show --predicate` command, making it the best choice for this forensic task.

Answer

FSEvents log files

Answer

.plist files in ~/Library/Preferences

Answer

~/Library/Application Support/com.apple.sharedfilelist

Question 9

Which Windows Event ID is generated when a new service is installed on a system?

Accepted Answer

7045. Event ID 7045 is logged in the Windows System event log when a new service is installed on the system. This event is generated by the Service Control Manager (SCM) and records the service name, binary path, service type, and start mode, making it a key artifact for forensic analysis of unauthorized service installations.

Answer

4624

Answer

4648

Answer

4720

Question 10

An analyst reviews NetFlow logs and sees a single internal host communicating with multiple external IPs on port 53 (DNS) over a short period, with each session transferring approximately 1500 bytes. What suspicious activity might this indicate?

Accepted Answer

DNS tunneling for data exfiltration. This behavior is classic for DNS tunneling, where an internal host encodes data into DNS queries or responses to exfiltrate information. The consistent 1500-byte payload size matches the maximum Ethernet MTU, suggesting data is being fragmented into DNS packets to bypass security controls. Normal DNS queries are typically much smaller (50-100 bytes), and the high frequency of connections to multiple external IPs indicates a covert channel rather than standard resolution.

Answer

A DNS amplification attack

Answer

Dynamic DNS update attempts

Answer

Normal DNS resolution for web browsing

Question 11

A Linux system is suspected of being used as a pivot point. An analyst checks /proc/[pid]/fd/ and sees open file descriptors pointing to sockets. Which command would BEST determine the remote connections associated with these sockets?

Accepted Answer

lsof -i. The `lsof -i` command lists open network sockets and their associated processes, including remote IP addresses and ports. Since the analyst already knows the PID from `/proc/[pid]/fd/`, `lsof -i` can directly map the socket file descriptors to remote connections, making it the best choice for identifying pivot points.

Answer

netstat -anp

Answer

cat /proc/net/tcp

Answer

ls -la /proc/[pid]/fd/

Question 12

A Linux system administrator notices unusual outbound connections from a server. Which of the following commands would MOST effectively capture a list of all current network connections along with the associated process IDs?

Accepted Answer

sudo ss -tunap. The `ss -tunap` command displays all TCP (`-t`), UDP (`-u`), and non-listening (`-n` for numeric, `-a` for all) sockets along with the associated process IDs (`-p`). This directly meets the requirement to capture current network connections and their PIDs for forensic analysis of unusual outbound traffic.

Answer

sudo iptables -L

Answer

sudo lsmod

Answer

sudo ifconfig -a

Question 13

A forensic analyst is investigating a Windows 10 system and needs to determine if a USB device was ever connected. Which registry key would provide a comprehensive list of USB devices that have been attached, including the first and last connection times?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum stores detailed information about USB mass storage devices that have been connected to the system, including the first and last connection timestamps in the Properties subkeys (e.g., {a8b865dd-2e3d-4094-ad97-e593a70c75d6}). This is the definitive location for forensic analysts to enumerate all attached USB storage devices and their connection history on Windows 10.

Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USB

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles

Question 14

During a forensic examination of a macOS system, an investigator wants to review application execution history. Which artifact contains a chronological record of application launches, including timestamps and process IDs?

Accepted Answer

Unified logging (log command). macOS unified logging provides detailed system activity including application launches. FSEvents records file system changes but not process launches. .plist files may store settings, not execution history.

Answer

FSEvents

Answer

com.apple.launchd.plist

Answer

syslog

Question 15

Which TWO Windows registry hives are most commonly analyzed during a forensic investigation to determine user activity and system configuration? (Select TWO.)

Accepted Answer

HKLM\SAM. Option A (HKLM\SAM) is correct because the Security Account Manager hive stores local user account information, including usernames, RIDs, password hashes, group memberships, and logon count/timestamp data, which directly supports determining who used the system and when. Option E (HKCU\...\NTUSER.DAT) is correct because each user's NTUSER.DAT hive records that user's activity and configuration, such as RecentDocs, RunMRU, TypedPaths, UserAssist, shellbags, and installed/configured application settings. Option B (HKU\.DEFAULT) is not one of the two most commonly cited hives for tying activity to a specific user, since it mainly holds defaults applied to new profiles before a user logs on. Option C (HKLM\COMPONENTS) is primarily used for servicing and component-store analysis rather than user activity attribution. Option D (HKLM\BCD) is not a standard registry hive for user activity; boot configuration data is normally stored in the BCD store, not analyzed as a user-activity hive.

Answer

HKU\.DEFAULT

Answer

HKLM\COMPONENTS

Answer

HKLM\BCD