CHFI OS and Network Forensics Practice Test 4 — 15 Questions

Question 1

During a macOS forensic investigation, which TWO artifacts would be MOST helpful in determining when a file was downloaded from the internet?

Accepted Answer

Quarantine database. Option C, the Quarantine database (~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2), is correct because macOS records a quarantine event with a timestamp (and often the source URL/agent) whenever a file is downloaded from the internet, directly answering when the download occurred. Option E, Apple Unified Logging, is correct because unified logs capture download-related activity from services such as nsurlsessiond, Safari, and other apps, including timestamps that can corroborate or supplement the quarantine record. Option A, kernel logs, is not appropriate because they record low-level hardware, driver, and system events rather than user file-download activity. Option B, .plist files in ~/Library/Preferences, is too broad: while the quarantine database itself is a plist, generic preference plists do not reliably timestamp internet downloads. Option D, FSEvents, only records filesystem change notifications (creation/modification paths) without reliably indicating that the file came from the internet or preserving the download source.

Answer

Kernel logs

Answer

.plist files in ~/Library/Preferences

Answer

FSEvents

Question 2

A security analyst reviewing Windows Security Event Logs sees multiple Event ID 4625 entries for a single user account, followed by a successful Event ID 4624. The account is a domain administrator. What is the MOST likely explanation?

Accepted Answer

An attacker performed a brute-force password attack and succeeded. Event ID 4625 indicates a failed logon attempt, while Event ID 4624 indicates a successful logon. A sequence of multiple 4625 events for the same domain administrator account followed by a single 4624 event is the classic signature of a successful brute-force password attack, where an attacker systematically tries passwords until one works. The fact that the account is a domain administrator makes it a high-value target, and the pattern of failures then success is inconsistent with simple user error or misconfiguration.

Answer

The user typed their password incorrectly several times before succeeding

Answer

The system experienced a denial of service attack

Answer

A misconfigured application caused repeated logon attempts

Question 3

During a forensic investigation of a compromised Linux server, you find the following entry in /var/log/auth.log: 'Mar 10 02:15:30 server sshd[1234]: Failed password for root from 10.0.0.5 port 54321 ssh2'. Which command would you use to extract all failed root login attempts from this log?

Accepted Answer

awk '/Failed password for root/' /var/log/auth.log. Both `awk '/Failed password for root/' /var/log/auth.log` and `grep 'Failed password for root' /var/log/auth.log` will extract all lines containing 'Failed password for root' from the auth.log file. The awk command prints every line matching the given regex, and grep does the same. Therefore, both A and B are correct. If the exam intends a single best answer, it needs clarification (e.g., asking for the 'most common' or 'simplest' command), but as written, both are valid.

Answer

grep 'Failed password for root' /var/log/secure

Answer

grep 'invalid.*root' /var/log/auth.log

Question 4

During a forensic examination of a Mac system, an investigator needs to recover historical record of file system events, such as file modifications and deletions. Which artifact should they examine?

Accepted Answer

FSEvents. FSEvents (File System Events) is a macOS framework that logs historical file system changes, including modifications, deletions, and renames, at the volume level. This data is stored in the `.fseventsd` directory and can be queried using the `fsevents` command or tools like `fs_usage`, making it the primary artifact for recovering a timeline of file system activity on a Mac.

Answer

.plist files

Answer

Unified logging

Answer

Syslog

Question 5

Which TWO of the following registry keys are commonly used to maintain persistence on Windows systems by automatically starting programs?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Option D, HKCU\Software\Microsoft\Windows\CurrentVersion\Run, is correct because the Run key under the current user's hive causes Windows to automatically launch the listed programs at each logon, making it a classic per-user persistence location. Option E, HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce, is correct because the RunOnce key under the machine hive automatically executes its entries once at the next logon or startup and then removes them, which is commonly abused for persistence. Option A, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, merely stores paths to user shell folders such as Desktop and Startup and does not itself launch programs. Option B, HKLM\SAM\SAM\Domains\Account\Users, holds local account and credential-related data, not autostart entries. Option C, HKLM\System\CurrentControlSet\Services, defines service configuration and can be abused for persistence, but it is not one of the two commonly cited Run/RunOnce autostart keys asked for here.

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Answer

HKLM\SAM\SAM\Domains\Account\Users

Answer

HKLM\System\CurrentControlSet\Services

Question 6

A security analyst captures network traffic and observes multiple TCP SYN packets sent to a range of IP addresses on port 445, followed by TCP RST packets after 15 seconds. Which THREE indicators suggest this is a network scan?

Accepted Answer

The packets are sent to sequential IP addresses in the same subnet. TCP SYN packets to multiple IPs on a single port indicate a port scan. The RST packets after a timeout suggest the targets did not respond, which is common in a sweep. Sequential IPs and the use of port 445 (SMB) are typical of scanning. The lack of established connections and the specific pattern confirm scanning.

Answer

The source IP is from an internal address

Answer

The payload contains exploit code for SMB vulnerability

Question 7

A network security analyst reviews firewall logs and identifies a high volume of outbound DNS queries to a known malicious domain from multiple internal hosts. Which THREE actions should the analyst take immediately?

Accepted Answer

Isolate the affected hosts from the network. Option A is correct because isolating the affected hosts from the network immediately stops further command-and-control communication and prevents lateral movement or additional data exfiltration while the incident is investigated. Option C is correct because blocking the malicious domain at the firewall or DNS level (for example, via a DNS sinkhole or firewall deny rule) prevents other internal hosts from resolving or reaching the known malicious infrastructure. Option D is correct because conducting a forensic analysis of the affected hosts preserves volatile evidence, identifies the malware or persistence mechanism, and determines the scope of compromise. Option B is not the immediate priority since signature-based antivirus scanning may miss the specific threat and does not contain the active communication. Option E, while useful for scoping, is a follow-up investigative step rather than an immediate containment action.

Answer

Update antivirus signatures and run a full scan

Answer

Review DNS logs to identify other potential malicious domains

Question 8

A forensic examiner is analyzing a Windows 10 system suspected of being accessed remotely without authorization. The examiner inspects the Security event log and finds Event ID 4648 entries with the subject user account WORKSTATION\jsmith and target account DOMAIN\administrator, where the process name is C:\Windows\System32\lsass.exe. What does this MOST likely indicate?

Accepted Answer

An explicit credential logon was performed, where jsmith supplied administrator credentials to start a process.. Event ID 4648 is generated when a process attempts a logon using explicitly provided credentials, often via Runas or a similar mechanism. Here, jsmith is the subject initiating the logon, and administrator is the target account whose credentials were supplied. The process lsass.exe is the standard component that handles such authentication requests, making this a clear indicator of explicit credential use, potentially malicious in this context.

Answer

A network logon was performed by jsmith using administrator credentials over SMB.

Answer

A service account logged on interactively to the workstation.

Answer

The administrator account was created by jsmith using a scheduled task.

Question 9

A security analyst investigates a Windows system and finds an event with ID 4625 in the Security log. What does this event indicate?

Accepted Answer

A failed logon attempt. Event ID 4625 in the Windows Security log specifically indicates a failed logon attempt. This event is generated by the Local Security Authority Subsystem Service (LSASS) whenever an authentication attempt fails, regardless of the logon type (interactive, network, service, etc.). The event details include the account name, source IP address, and failure reason code (e.g., 0xC000006D for bad username/password).

Answer

A successful user logon

Answer

A service was installed

Answer

A new user account was created

Question 10

During a forensic analysis of a compromised Linux server, you notice that the file /var/log/auth.log has been cleared. However, you find that the attacker's commands are still partially recoverable. Which artifact most likely contains the attacker's command history?

Accepted Answer

~/.bash_history. The ~/.bash_history file stores the command history for individual user accounts, including commands executed by an attacker who gained shell access. Even if /var/log/auth.log is cleared, this file retains the attacker's command history unless explicitly deleted or truncated. This makes it a key artifact for recovering attacker activity.

Answer

/var/log/syslog

Answer

/proc/1/cmdline

Answer

/etc/shadow

Question 11

An analyst suspects that an attacker used a web shell to execute commands on a Windows web server. Which Windows event ID should the analyst look for to detect service installation that may have been used for persistence?

Accepted Answer

7045. Event ID 7045 is logged by the Windows Service Control Manager when a new service is installed on the system. An attacker who gains a web shell often installs a malicious service to maintain persistence, and this event captures the service name, binary path, and service type, making it the primary forensic artifact to detect such activity.

Answer

4624

Answer

4648

Answer

4720

Question 12

A forensic examiner is analyzing a Mac system and wants to review system logs that record various activities, including application launches and kernel events. Which logging system on macOS should be examined?

Accepted Answer

Unified logging (log command). Unified logging (log command) is the correct answer because macOS has consolidated all system and user-level logs into a single, high-performance unified logging system since macOS 10.12 (Sierra). This system captures kernel events, application launches, and other activities in a structured, binary format that can be queried using the 'log' command-line tool or the Console app. It is the primary and most comprehensive source for forensic analysis of system activity on modern macOS systems.

Answer

.plist files

Answer

FSEvents

Answer

Console.app logs

Question 13

A network analyst is reviewing a packet capture and sees a large number of TCP SYN packets sent to various ports on a single host from multiple source IPs. This pattern is most indicative of which type of attack?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets with spoofed source IPs to a target host. The target allocates resources for each half-open connection, exhausting its backlog queue and preventing legitimate connections. The pattern of many SYN packets from multiple IPs to various ports matches this attack's signature.

Answer

ARP spoofing

Answer

DNS amplification

Answer

Ping of death

Question 14

During a Linux forensic investigation, you find that the file /etc/cron.d/evil contains the entry: '* * * * * root /bin/bash /root/backdoor.sh'. What persistence mechanism is being used?

Accepted Answer

Cron job. The entry in /etc/cron.d/evil follows the standard crontab format (minute, hour, day, month, weekday, user, command) and is placed in a system cron directory, making it a cron job. Cron jobs are a common Linux persistence mechanism that execute commands at scheduled intervals, and this one runs /root/backdoor.sh every minute as root.

Answer

Systemd service

Answer

Init script

Answer

At job

Question 15

In network forensics, which tool is commonly used to analyze and visualize NetFlow data to identify network traffic patterns?

Accepted Answer

SolarWinds NetFlow Traffic Analyzer. SolarWinds NetFlow Traffic Analyzer (NTA) is specifically designed to collect, analyze, and visualize NetFlow data (and other flow protocols like sFlow, IPFIX, and J-Flow) to identify network traffic patterns, bandwidth usage, and top talkers. Unlike packet-level tools, NTA works on flow records exported by routers and switches, making it ideal for high-level traffic pattern analysis in network forensics.

Answer

Wireshark

Answer

Splunk

Answer

Nmap