CHFI OS and Network Forensics Practice Test 3 — 15 Questions

Question 1

During a Windows forensic investigation, an analyst finds a registry key under NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count. What type of artifact is this, and what information does it typically contain?

Accepted Answer

UserAssist entries that record program execution history with counts and timestamps. UserAssist keys track programs launched via Windows Explorer, recording the executable path, last execution time, and run count. This is a common artifact for determining application usage.

Answer

Jump list data from the taskbar showing recently opened files

Answer

Prefetch file metadata indicating application launch times

Answer

ShellBags data displaying folder view settings and sizes

Question 2

In Linux forensics, an investigator examines /var/log/auth.log and finds repeated entries of "Failed password for root from 10.0.0.5 port 22 ssh2". Which type of attack is most likely indicated?

Accepted Answer

Brute force attack on SSH. Repeated failed SSH login attempts for the root user from a single IP address is a classic sign of a brute force attack against SSH.

Answer

DNS cache poisoning attack

Answer

SQL injection attack

Answer

ARP spoofing attack

Question 3

A security analyst reviews the following Windows Event log entry: Event ID 4648 with logon type 3, subject user 'CONTOSO\admin', target server 'FS01', target user 'CONTOSO\backupadmin'. What does this event indicate?

Accepted Answer

An explicit credential logon was performed to access FS01 using the backupadmin account. Event ID 4648 records when explicit credentials are used to logon, typically for RunAs or scheduled tasks. Logon type 3 indicates network logon. This means admin used backupadmin credentials to access FS01.

Answer

A user account was created for backupadmin on FS01

Answer

A service was installed under the backupadmin account

Answer

The backupadmin account locked out due to multiple failed attempts

Question 4

A forensic examiner needs to extract timeline data from a compromised Linux system for analysis with log2timeline/Plaso. Which of the following command sequences should be used?

Accepted Answer

log2timeline.py --partition /dev/sda1 timeline.plaso && psort.py -o l2tcsv timeline.plaso. log2timeline (now Plaso) typically uses log2timeline.py to create a storage file, then psort.py to output the timeline in a readable format.

Answer

bulk_extractor -o timeline.csv /dev/sda1

Answer

plaso.py -i /var/log -o timeline.csv

Answer

sleuthkit_timeline -m /mnt/evidence -d timeline.csv

Question 5

In network forensics, an analyst captures traffic and sees a large number of ICMP echo requests from 10.0.0.1 to 10.0.0.2 with varying payload sizes. What is the most likely scenario?

Accepted Answer

Network reconnaissance (ping sweep). Large numbers of ICMP echo requests (pings) with varying payload sizes are characteristic of a ping sweep or network reconnaissance to identify live hosts.

Answer

A man-in-the-middle attack

Answer

A DoS attack using ICMP floods

Answer

A DNS amplification attack

Question 6

During a Mac OS X forensic investigation, an analyst wants to review user application usage and system events for the last week. Which artifact provides a centralized, binary log of these activities?

Accepted Answer

FSEvents files in /.fseventsd. FSEvents is a macOS feature that logs file system events in a binary format, useful for tracking file creation, modification, and deletion.

Answer

.plist files in ~/Library/Preferences

Answer

Unified logging (log stream)

Answer

Quick Look server logs

Question 7

An incident responder finds a suspicious LNK file in a user's Startup folder on a Windows system. The LNK file's target is "C:\Windows\System32\rundll32.exe" with a command-line argument "javascript:" followed by encoded text. What is the most likely purpose of this shortcut?

Accepted Answer

A malicious persistence mechanism to execute payload via script. Rundll32.exe executing JavaScript is a known technique for code execution, often used by malware to run scripts for persistence or payload delivery.

Answer

A shortcut to a network resource that failed

Answer

Legitimate update mechanism for Microsoft Office

Answer

A user-created automation script for daily tasks

Question 8

A forensic examiner is analyzing a compromised Linux server and notices that /etc/cron.daily contains a script named 'sysupdate.sh' that runs a base64-encoded command. Which persistence mechanism is being used?

Accepted Answer

Cron job for daily execution. Cron jobs in /etc/cron.daily are scheduled tasks that run daily. Malicious scripts placed there provide persistence by re-executing at regular intervals.

Answer

LD_PRELOAD library injection

Answer

Systemd service

Answer

SSH authorized_keys backdoor

Question 9

In a Windows forensic investigation, the analyst wants to determine which USB devices were connected to the system, including the device serial number and first/last connection times. Which registry hive and key should be examined?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. USB device history is stored in the SYSTEM registry hive under USBSTOR, which records device class, serial number, and timestamps.

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKLM\SAM\SAM\Domains\Account\Users

Question 10

Which Wireshark filter should an analyst use to display only TCP packets that have the SYN flag set and the ACK flag not set?

Accepted Answer

tcp.flags.syn == 1 and tcp.flags.ack == 0. A TCP SYN packet has SYN=1 and ACK=0. The Wireshark display filter 'tcp.flags.syn == 1 and tcp.flags.ack == 0' precisely matches this condition.

Answer

tcp.flags.syn == 1 or tcp.flags.ack == 0

Answer

tcp.flags.syn == 1

Answer

tcp.flags == 0x002

Question 11

An analyst reviews proxy logs and sees repeated requests to a known malicious domain from multiple internal hosts, each using a different User-Agent string. The requests are all GET requests for /images/icon.png. What technique is most likely being used to evade detection?

Accepted Answer

User-Agent randomization. Using different User-Agent strings per request is a common evasion technique to avoid signature-based detection that relies on a single User-Agent.

Answer

HTTPS tunneling

Answer

IP spoofing

Answer

Domain generation algorithm (DGA)

Question 12

Which Windows Event ID is generated when a service is installed on a system?

Accepted Answer

7045. Event ID 7045 is logged when a new service is installed on a Windows system, providing details such as service name, binary path, and account.

Answer

4624

Answer

4688

Answer

4720

Question 13

Which TWO of the following are valid artifacts for determining program execution on a Windows system? (Select TWO.)

Accepted Answer

Jump Lists. Prefetch files store execution information for applications, and Jump Lists track recent files opened by applications, indicating usage.

Answer

Pagefile.sys

Answer

System Restore points

Answer

Windows Error Reporting logs

Question 14

Which THREE of the following are common indicators of a web shell on a compromised web server? (Select THREE.)

Accepted Answer

Files with obfuscated code (e.g., base64 encoded strings). Web shells often contain obfuscated code, are placed in web-accessible directories, and may be accessed via unusual HTTP methods like POST with encoded payloads.

Answer

Presence of .htaccess files with rewrite rules

Answer

High number of 404 errors in access logs

Question 15

Which TWO of the following tools are primarily used for timeline analysis in digital forensics? (Select TWO.)

Accepted Answer

The Sleuth Kit (mactime). Plaso (log2timeline) and The Sleuth Kit (with mactime) are both used to create super timelines from file system metadata.

Answer

Nmap

Answer

Autopsy

Answer

Wireshark