CHFI OS and Network Forensics Practice Test 3 — 15 Questions

Question 1

A forensic examiner needs to extract timeline data from a compromised Linux system for analysis with log2timeline/Plaso. Which of the following command sequences should be used?

Accepted Answer

log2timeline.py --partition /dev/sda1 timeline.plaso && psort.py -o l2tcsv timeline.plaso. Log2timeline/Plaso workflow requires first creating a Plaso storage file with log2timeline.py (processing /dev/sda1 as a partition), then exporting it to a timeline CSV with psort.py using the l2tcsv output module. This two-step process preserves the forensic integrity of the timeline data and allows for filtering before export.

Answer

bulk_extractor -o timeline.csv /dev/sda1

Answer

plaso.py -i /var/log -o timeline.csv

Answer

sleuthkit_timeline -m /mnt/evidence -d timeline.csv

Question 2

During a Mac OS X forensic investigation, an analyst wants to review user application usage and system events for the last week. Which artifact provides a centralized, binary log of these activities?

Accepted Answer

FSEvents files in /.fseventsd. FSEvents (File System Events) in /.fseventsd is a centralized, binary log that records all file system changes, including application usage and system events, on a per-volume basis. It provides a historical timeline of modifications (e.g., file creation, deletion, renaming) that can be parsed to reconstruct user activity over the last week, making it the correct artifact for this forensic review.

Answer

.plist files in ~/Library/Preferences

Answer

Unified logging (log stream)

Answer

Quick Look server logs

Question 3

An incident responder finds a suspicious LNK file in a user's Startup folder on a Windows system. The LNK file's target is "C:\Windows\System32\rundll32.exe" with a command-line argument "javascript:" followed by encoded text. What is the most likely purpose of this shortcut?

Accepted Answer

A malicious persistence mechanism to execute payload via script. The LNK file targets rundll32.exe with a JavaScript command-line argument, which is a known technique for executing arbitrary script code without writing a traditional executable to disk. This is commonly used by malware to establish persistence by placing the shortcut in the Startup folder, ensuring the script runs each time the user logs in.

Answer

A shortcut to a network resource that failed

Answer

Legitimate update mechanism for Microsoft Office

Answer

A user-created automation script for daily tasks

Question 4

A forensic examiner is analyzing a compromised Linux server and notices that /etc/cron.daily contains a script named 'sysupdate.sh' that runs a base64-encoded command. Which persistence mechanism is being used?

Accepted Answer

Cron job for daily execution. The presence of a script named 'sysupdate.sh' inside /etc/cron.daily indicates that the system's cron daemon is configured to execute this script once per day. Cron jobs are a standard Linux persistence mechanism, and placing a script in /etc/cron.daily ensures it runs automatically on a daily schedule, making option B correct.

Answer

LD_PRELOAD library injection

Answer

Systemd service

Answer

SSH authorized_keys backdoor

Question 5

In a Windows forensic investigation, the analyst wants to determine which USB devices were connected to the system, including the device serial number and first/last connection times. Which registry hive and key should be examined?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum contains a subkey for each USB mass storage device that has ever been connected to the system. Each subkey includes the device's serial number (as the subkey name) and, under the Properties subkey, the first connection timestamp (Property value 0064) and last connection timestamp (Property value 0065). This is the definitive forensic source for USB device history in Windows.

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKLM\SAM\SAM\Domains\Account\Users

Question 6

Which Wireshark filter should an analyst use to display only TCP packets that have the SYN flag set and the ACK flag not set?

Accepted Answer

tcp.flags.syn == 1 and tcp.flags.ack == 0. The filter `tcp.flags.syn == 1 and tcp.flags.ack == 0` uses the logical AND operator to require that the SYN flag is set (value 1) and the ACK flag is not set (value 0). This precisely matches the condition for a TCP SYN packet that is not part of a SYN-ACK handshake response, which is exactly what the analyst needs to isolate.

Answer

tcp.flags.syn == 1 or tcp.flags.ack == 0

Answer

tcp.flags.syn == 1

Answer

tcp.flags == 0x002

Question 7

An analyst reviews proxy logs and sees repeated requests to a known malicious domain from multiple internal hosts, each using a different User-Agent string. The requests are all GET requests for /images/icon.png. What technique is most likely being used to evade detection?

Accepted Answer

User-Agent randomization. The repeated GET requests for the same resource (/images/icon.png) from multiple internal hosts, each with a different User-Agent string, is a classic indicator of User-Agent randomization. This technique is used by malware to evade signature-based detection that relies on static User-Agent values, making the traffic appear to originate from diverse browsers or devices.

Answer

HTTPS tunneling

Answer

IP spoofing

Answer

Domain generation algorithm (DGA)

Question 8

Which Windows Event ID is generated when a service is installed on a system?

Accepted Answer

7045. Event ID 7045 is logged in the Windows System event log when a new service is installed on the system. This event records the service name, image path, service type, and start mode, making it a critical artifact for forensic investigators tracking unauthorized service installations.

Answer

4624

Answer

4688

Answer

4720

Question 9

Which THREE of the following are common indicators of a web shell on a compromised web server? (Select THREE.)

Accepted Answer

Files with obfuscated code (e.g., base64 encoded strings). Web shells often use obfuscated code, such as base64-encoded strings, to hide malicious commands from security tools and system administrators. Option C is correct because web shells are typically placed in web-accessible directories like /uploads and require execute permissions to run commands. Option E is correct because web shells often receive large POST payloads containing commands, which is abnormal for normal scripts. Option A is incorrect; .htaccess rewrite rules are a legitimate Apache feature and not a direct indicator of a web shell. Option D is incorrect; while web shells may cause 404 errors, a high number of 404s is not a specific indicator of a web shell.

Answer

Presence of .htaccess files with rewrite rules

Answer

High number of 404 errors in access logs

Question 10

Which TWO of the following tools are primarily used for timeline analysis in digital forensics? (Select TWO.)

Accepted Answer

The Sleuth Kit (mactime). The Sleuth Kit's mactime tool is specifically designed to parse file system metadata (MAC times: modification, access, and change) and generate a timeline of file activity, which is essential for reconstructing events in a forensic investigation. Plaso (formerly log2timeline) is a super timeline tool that aggregates timestamps from multiple sources (e.g., registry, event logs, file system) into a unified timeline, making it a primary choice for timeline analysis.

Answer

Nmap

Answer

Autopsy

Answer

Wireshark

Question 11

A forensic analyst examining a Windows machine finds a suspicious service named 'SrvMon' installed. The System event log shows Event ID 7045 at the time of compromise. What does this event indicate?

Accepted Answer

A service was installed. Event ID 7045 in the Windows System event log is specifically generated when a new service is installed on the system. The forensic analyst found a suspicious service named 'SrvMon', and the presence of this event at the time of compromise directly indicates that the service was installed, making option C correct.

Answer

A logon attempt failed

Answer

A user account was created

Answer

A scheduled task was created

Question 12

During a Linux forensic investigation, you find that the file /var/log/auth.log has been deleted. Which of the following artefacts would BEST help determine recent SSH login attempts?

Accepted Answer

Output of the 'last' command. The 'last' command reads the /var/log/wtmp binary log file, which records all login and logout events, including SSH sessions. Even if /var/log/auth.log is deleted, the wtmp file persists and provides a reliable record of recent SSH login attempts, making option D the best choice.

Answer

Contents of /etc/shadow

Answer

Bash history from /root/.bash_history

Answer

Cron job entries in /etc/crontab

Question 13

An analyst reviews Windows Registry for USB device usage history. Which registry hive and key contain the 'USBSTOR' key that logs unique serial numbers of connected USB drives?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key is located under HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR and logs each unique USB device by its serial number. This hive is part of the SYSTEM registry, which maintains device enumeration data used by the Plug and Play manager to track connected hardware. Forensic analysts examine this key to identify USB drive insertion history, including first and last connection timestamps.

Answer

HKLM\SAM\SAM\Domains\Account\Users

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Question 14

In Windows forensics, which artifact is a database of metadata about files and applications accessed by the user, used to populate the 'Recent Items' and 'Quick Access' lists?

Accepted Answer

Jumplists. Jumplists are the correct answer because they are a Windows artifact that stores metadata about recently accessed files and applications, directly populating the 'Recent Items' and 'Quick Access' lists in the taskbar and File Explorer. Each jumplist is a database file (e.g., .automaticDestinations-ms or .customDestinations-ms) containing entries with timestamps, file paths, and application IDs, making them a key source for forensic reconstruction of user activity.

Answer

Prefetch files

Answer

LNK files

Answer

ShellBags

Question 15

A forensic examiner finds a suspicious entry in the Linux file /etc/passwd: 'backdoor:x:0:0:root:/root:/bin/bash'. What is the MOST significant security issue with this entry?

Accepted Answer

The UID is 0, granting root privileges. The UID (user ID) of 0 is the root user identifier in Linux. Any account with UID 0 is granted the same privileges as the root user, regardless of the account name. This entry effectively creates a backdoor account with full administrative control over the system, bypassing normal authentication and accountability measures.

Answer

The entry has no password hash

Answer

The home directory is set to /root

Answer

The shell is /bin/bash