CHFI OS and Network Forensics Practice Test 3 — 15 Questions

Question 1

Which TWO of the following are primary locations for browser history artifacts in a Windows 10 system? (Select TWO.)

Accepted Answer

%USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\History. Option B is correct because Google Chrome stores its browsing history in an SQLite database named 'History' under the user's profile at %USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\History, making it a primary artifact location. Option C is correct because Microsoft Edge and Internet Explorer on Windows 10 store history, cache, and cookie records in the ESE database WebCacheV01.dat located at %USERPROFILE%\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat. Option D is correct because Mozilla Firefox stores browsing history in the SQLite database places.sqlite within each profile folder under %USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\*.default\. Option A is not a primary history location on Windows 10; the legacy 'Temporary Internet Files' path is largely a compatibility junction and does not hold the structured history records. Option E is incorrect because %USERPROFILE%\AppData\Local\Temp is a general temporary file directory, not a dedicated browser history artifact store.

Answer

%USERPROFILE%\AppData\Local\Microsoft\Windows\Temporary Internet Files

Answer

%USERPROFILE%\AppData\Local\Temp

Question 2

During a forensic investigation of a Windows system, an analyst examines the NTUSER.DAT registry hive. Which artifact would MOST likely be found to identify recently accessed documents and folders via the Windows Explorer GUI?

Accepted Answer

ShellBags. ShellBags are stored in the NTUSER.DAT hive under the BagMRU and Bags keys, and they track the view settings and paths of folders and documents accessed via Windows Explorer. This makes them the definitive artifact for identifying recently accessed folders and documents through the GUI, as they persist even after the files themselves are deleted or moved.

Answer

Run keys

Answer

MRU lists

Answer

UserAssist

Question 3

During a Mac forensic examination, an investigator needs to find evidence of recently executed applications and accessed files. Which artifact should the investigator prioritize for reconstructing user activity?

Accepted Answer

Unified logging. Unified logging (C) is the correct artifact because it centrally records process execution events (application launches) and system/file activity, making it the most suitable for reconstructing user activity. FSEvents only captures file system changes (creation, modification, deletion, renaming) and does not log process execution or file reads. bash_history only covers shell commands, and plist preferences contain app settings rather than a direct record of execution/access.

Answer

bash_history

Answer

FSEvents

Answer

.plist files in ~/Library/Preferences

Question 4

A network analyst captures suspicious traffic and uses Wireshark to examine packets. The analyst notices many TCP SYN packets sent to various ports on a single host with no SYN-ACK replies. What type of activity is MOST likely observed?

Accepted Answer

Port scan. The observation of multiple TCP SYN packets sent to various ports on a single host without any SYN-ACK replies is the classic signature of a TCP SYN port scan. In a port scan, the attacker sends SYN packets to probe which ports are open; if a port is closed, the host responds with a RST packet, but if no SYN-ACK is returned, it typically indicates the port is filtered (blocked by a firewall) or the host is not responding. This behavior is distinct from a DoS attack, which would flood a single port with traffic to overwhelm the target.

Answer

Denial of Service (DoS) attack

Answer

DNS amplification

Answer

ARP poisoning

Question 5

A forensic analyst finds an LNK file on a Windows system pointing to a script located in a temporary folder. The LNK file's timestamps show creation time after the script's known execution time. What does this discrepancy likely indicate?

Accepted Answer

The LNK file was planted by an attacker to mislead timeline analysis. The LNK file's creation timestamp being after the script's execution time indicates that the LNK file was not created by the normal execution of the script. In Windows, when a user or process accesses a file via a shortcut, the LNK file's timestamps are not updated to reflect the target's execution time. An attacker can plant a pre-created LNK file with a fabricated creation timestamp to mislead forensic timeline analysis, making it appear as if the script was executed at a different time or by a different mechanism.

Answer

The system clock was changed

Answer

The file system is corrupted

Answer

The script was executed normally

Question 6

An investigator finds a webshell on a compromised web server. Which artifact would be MOST useful to determine what commands were executed through the webshell?

Accepted Answer

Web server access logs. Web server access logs record every HTTP request made to the server, including the URI, method, user-agent, and response status. When a webshell is accessed, commands are typically passed via GET or POST parameters in the request URL or body, so the access log will contain the exact command strings executed. This makes it the most direct artifact for reconstructing attacker actions.

Answer

Firewall logs

Answer

System event logs

Answer

Prefetch files

Question 7

Which TWO Windows Event IDs are associated with successful logon events? (Select two.)

Accepted Answer

4648. Event ID 4624 is the classic Security log entry generated when a logon attempt succeeds, recording the logon type, account, and source; it is the primary successful-logon event. Event ID 4648 is also correct because it is logged when a process explicitly supplies credentials to log on, such as with RunAs or a scheduled task using stored credentials, indicating a successful logon using explicit credentials. Event ID 4625 is not correct because it records a failed logon attempt. Event ID 7045 is not correct because it is a System log event indicating a new service was installed. Event ID 4720 is not correct because it records that a user account was created, not a logon.

Answer

4625

Answer

7045

Answer

4720

Question 8

A Linux system administrator notices unusual outbound connections from a server. Which log file should be examined FIRST to identify authentication attempts related to the compromised account?

Accepted Answer

/var/log/auth.log. On Linux systems, /var/log/auth.log (Debian/Ubuntu) is the primary log file that records authentication events, including successful and failed login attempts, sudo usage, and SSH connections. Since the question involves identifying authentication attempts related to a compromised account, this log is the first place to check for evidence of unauthorized access.

Answer

/var/log/messages

Answer

/var/log/secure

Answer

/var/log/syslog

Question 9

During a network forensic investigation, an analyst examines a pcap file and finds multiple TCP SYN packets sent to a target IP on port 80, each from a different source IP address. No SYN-ACK packets are returned, but the target continues to send SYN-ACK responses for earlier packets. What attack is MOST likely occurring?

Accepted Answer

SYN flood attack. The scenario describes a classic SYN flood attack: the attacker sends many TCP SYN packets with spoofed source IP addresses to a target on port 80. The target responds with SYN-ACK packets to each spoofed source, but because the sources are unreachable or non-existent, the target never receives the final ACK to complete the three-way handshake. This leaves the target's connection table filled with half-open connections, exhausting resources and preventing legitimate connections.

Answer

UDP flood attack

Answer

ARP spoofing attack

Answer

DNS amplification attack

Question 10

A forensic analyst is examining a compromised Linux server and finds a suspicious binary running as a service. Which file should be checked to determine if the binary is set to start at boot?

Accepted Answer

/etc/crontab. The /etc/crontab file is the system-wide crontab file that can be used to schedule tasks, including starting a binary at boot time by using the @reboot directive. This is a common method for ensuring a service or binary starts automatically when the system boots, making it the correct file to check in this scenario.

Answer

/etc/shadow

Answer

/var/log/auth.log

Answer

/etc/passwd

Question 11

During a network forensics investigation, an analyst reviews NetFlow data and notices a one-way flow of UDP traffic from an internal host to an external IP on port 53. However, the packet capture shows the external IP responding with large DNS responses. What type of data exfiltration technique is MOST likely being used?

Accepted Answer

DNS tunneling. The one-way NetFlow view of UDP traffic to port 53 suggests DNS queries, but the packet capture reveals large DNS responses from the external IP. This is classic DNS tunneling, where data is exfiltrated by encoding it in DNS query names and receiving responses that carry command-and-control data or additional exfiltrated content within the resource record fields (e.g., TXT records). The asymmetry between NetFlow (which only logs the initial query direction) and full packet capture (which shows the response) is the key clue.

Answer

ICMP tunneling

Answer

SSH tunneling

Answer

HTTP tunneling

Question 12

A network forensic analyst captures traffic that includes the following Wireshark filter: "tcp.port == 22 and tcp.flags.syn == 1 and tcp.flags.ack == 0". What type of traffic is this filter selecting?

Accepted Answer

Outgoing SSH connection attempts. The filter `tcp.port == 22 and tcp.flags.syn == 1 and tcp.flags.ack == 0` selects TCP packets with a destination or source port of 22 (SSH) where the SYN flag is set and the ACK flag is not set. This combination identifies the initial SYN packet of a TCP three-way handshake, which represents a new connection attempt. Since port 22 is SSH, this filter specifically captures outgoing SSH connection attempts (SYN packets) before any session is established or payload is exchanged.

Answer

SSH traffic with payload

Answer

SSH key exchange

Answer

SSH established sessions

Question 13

A forensic tool parses the Windows registry and reveals that a USB device with VID_0781&PID_5583 was last connected on 2023-10-01. Which registry key is the MOST likely source of this information?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under Enum in the SYSTEM hive stores detailed history of USB mass storage devices, including the VID/PID (vendor and product identifiers) and the last connection timestamp. This specific key is the authoritative source for device enumeration and connection times for USB storage devices in Windows.

Answer

HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB

Answer

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Question 14

A forensic examiner uses Plaso (log2timeline) to create a timeline from a disk image. Which of the following artifacts would NOT be included in the timeline by default using the 'all' parser?

Accepted Answer

Chrome browser history. The 'all' parser set in Plaso includes most common forensic artifacts, but it deliberately excludes browser history artifacts such as Chrome history to reduce processing time and data volume. The SAM registry hive, Event Logs, and Prefetch files are all included by default.

Answer

Event Log entries (evtx)

Answer

Registry SAM hive entries

Answer

Windows Prefetch files

Question 15

A security analyst detects suspicious outbound traffic to multiple external IPs on port 443. Which THREE network forensic data sources should be examined to identify the infected host and the nature of the communication?

Accepted Answer

Proxy logs. Firewall logs, proxy logs, and IDS/IPS logs are essential: firewall logs show allowed/denied connections, proxy logs reveal HTTP/HTTPS traffic details, and IDS/IPS logs detect malicious payloads.

Answer

Packet captures (PCAP)

Answer

NetFlow data