CHFI OS and Network Forensics Practice Test 4 — 15 Questions

Question 1

A security analyst needs to examine network traffic for signs of a data exfiltration attempt. Which tool is specifically designed for deep packet inspection and can reconstruct TCP streams?

Accepted Answer

Wireshark. Wireshark is the correct choice because it is specifically designed for deep packet inspection (DPI) and can reconstruct TCP streams by following the TCP sequence numbers and reassembling the application-layer data. This allows an analyst to view the full content of a data exfiltration attempt, such as an HTTP POST or FTP transfer, even if the packets are fragmented or out of order.

Answer

Tcpdump

Answer

Netstat

Answer

Nmap

Question 2

During a Mac forensic investigation, you examine the unified log for process execution around the time of an incident. Which command-line tool is used to query the macOS unified log?

Accepted Answer

log. The `log` command is the native macOS tool for querying the unified log system, which consolidates kernel, driver, and application logs into a single, high-performance data store. It supports filtering by process, time range, and subsystem, making it essential for forensic timeline reconstruction on macOS. Unlike traditional syslog, the unified log uses a binary format that only `log` can efficiently parse.

Answer

journalctl

Answer

dmesg

Answer

syslog

Question 3

A forensic analyst finds multiple Prefetch files in C:\Windows\Prefetch with recent timestamps. What is the primary value of Prefetch files in an investigation?

Accepted Answer

They record the first and last execution times of applications. Prefetch files in Windows store metadata about application launches, including the first and last execution times. This allows forensic analysts to determine when a specific program was run, which is crucial for timeline analysis and identifying unauthorized or malicious software execution.

Answer

They store the user's web browsing history

Answer

They list all network connections made by the system

Answer

They contain the actual content of user documents

Question 4

In network forensics, which type of log is BEST for identifying all outbound connections from internal hosts to external IP addresses on specific ports?

Accepted Answer

Firewall logs. Firewall logs are the best choice because they explicitly record the source IP, destination IP, destination port, and action (allow/deny) for every outbound connection attempt. Unlike other logs, firewall logs are specifically designed to enforce and log policy-based traffic filtering, making them the definitive source for identifying all outbound connections to external IPs on specific ports.

Answer

IDS logs

Answer

Proxy logs

Answer

NetFlow logs

Question 5

A forensic tool outputs a timeline of file system events. The analyst needs to correlate registry modifications with file creation times. Which tool is specifically designed for super timeline creation from multiple sources?

Accepted Answer

Plaso. Plaso (log2timeline) is specifically designed to create super timelines by aggregating and correlating events from multiple sources, including file system metadata, registry hives, and event logs. It parses artifacts like NTFS $MFT, USN journal, and registry keys (e.g., NTUSER.DAT) to produce a unified timeline, enabling the analyst to correlate registry modifications with file creation times.

Answer

Autopsy

Answer

Volatility

Answer

Sleuth Kit

Question 6

An investigator finds a suspicious LNK file on a Windows desktop pointing to an executable in the Temp folder. What is the significance of LNK files in forensic analysis?

Accepted Answer

They provide evidence of file access and execution. LNK files (Windows shortcuts) contain metadata about the target file, including its path, creation/modification timestamps, and volume information. When a user double-clicks an LNK file, Windows follows the link to execute the target, so the presence of an LNK file pointing to an executable in the Temp folder is strong evidence that the executable was accessed or executed from that location. This is critical in forensic analysis for reconstructing user activity and identifying potential malware execution.

Answer

They store network share credentials in plaintext

Answer

They contain the full content of the target file

Answer

They are used exclusively for system files

Question 7

An analyst is reviewing a Linux system for signs of a rootkit. Which THREE of the following are common indicators of a rootkit infection? (Select THREE.)

Accepted Answer

Anomalies in the /proc filesystem. The /proc filesystem is a virtual filesystem that provides a dynamic view of kernel and process information. Rootkits often hide processes, network connections, or files by manipulating /proc entries, so anomalies such as missing or inconsistent process listings, hidden PIDs, or unexpected entries are strong indicators of rootkit activity.

Answer

Incorrect file permissions on /etc/passwd

Answer

Large number of failed SSH login attempts

Question 8

A network forensic investigator is analyzing traffic from a compromised web server. Which TWO artifacts are MOST likely to indicate the presence of a web shell? (Select TWO.)

Accepted Answer

Presence of a suspicious .aspx or .php file in web directories. Web shells are typically uploaded as script files (e.g., .aspx, .php, .jsp) into web-accessible directories. Their presence in these directories is a direct indicator of a web shell, as they allow an attacker to execute arbitrary commands via the web server. Option D is correct because web shells often receive commands via HTTP POST requests to non-standard or hidden scripts, which deviate from the expected application flow and are a strong forensic indicator.

Answer

Multiple DNS queries to external domains

Answer

Excessive SYN-ACK packets

Answer

High volume of ICMP traffic

Question 9

A security analyst reviews Windows Security event logs and finds Event ID 4625 with Logon Type 10. What does this indicate?

Accepted Answer

Failed remote interactive logon (e.g., RDP). Event ID 4625 with Logon Type 10 specifically indicates a failed Remote Interactive logon attempt, which is characteristic of Remote Desktop Protocol (RDP) connections. Logon Type 10 is defined in Windows security auditing as 'RemoteInteractive' and is triggered when an authentication attempt fails over a remote desktop session, typically using RDP (port 3389). This event is critical for detecting brute-force or unauthorized RDP access attempts.

Answer

Failed service logon attempt

Answer

Successful network logon

Answer

Successful local logon

Question 10

Which Windows Registry hive is primarily used to store user-specific application settings and recently accessed files?

Accepted Answer

NTUSER.DAT. NTUSER.DAT is the correct answer because it is the registry hive file that stores per-user settings, including application configurations and recently accessed files (e.g., MRU lists). When a user logs on, Windows loads NTUSER.DAT into HKEY_CURRENT_USER (HKCU), making it the primary repository for user-specific data.

Answer

HKU\.DEFAULT

Answer

HKLM\SYSTEM

Answer

HKLM\SAM

Question 11

During a Linux forensic investigation, you find that the /var/log/auth.log file contains log entries showing multiple 'Failed password for root' messages from a single IP address, followed by a 'Accepted password for root' entry. What is the MOST likely conclusion?

Accepted Answer

An attacker successfully brute-forced the root password. The sequence of multiple 'Failed password for root' entries followed by an 'Accepted password for root' entry from the same IP address is the classic signature of a successful brute-force attack against the root account. SSH authentication logs record each attempt, and a successful login after repeated failures indicates that the attacker guessed or cracked the password, not that a privilege escalation or lockout occurred.

Answer

The root user accidentally mistyped the password multiple times

Answer

The system was compromised via a privilege escalation exploit

Answer

The root account has been locked out due to multiple failures

Question 12

In Windows forensics, which artifact is used to track recently executed programs on a per-user basis?

Accepted Answer

UserAssist. UserAssist is a Windows registry key (under NTUSER.DAT) that records the execution count and last execution time of GUI-based programs for each user. It is specifically designed to track recently executed programs on a per-user basis, making it the correct artifact for this forensic question.

Answer

Jump lists

Answer

ShellBags

Answer

Prefetch files

Question 13

A network forensic analyst captures packets and sees a TCP SYN packet sent to port 80, followed by a SYN-ACK, then an ACK, and then an HTTP GET request. What can be concluded?

Accepted Answer

The TCP connection was successfully established. The TCP three-way handshake (SYN, SYN-ACK, ACK) completes successfully, establishing a connection. The subsequent HTTP GET request confirms the connection is fully open and usable for application-layer data transfer. This is the standard sequence for a normal TCP connection establishment.

Answer

The session was hijacked after the handshake

Answer

A TCP half-open scan was performed

Answer

The connection was refused by the server

Question 14

During a forensic examination of a macOS system, you find a file at /private/var/log/system.log and also notice a directory /private/var/db/diagnostics/. What is the significance of these locations?

Accepted Answer

The diagnostics directory contains binary log data from the unified logging system. /private/var/db/diagnostics/ stores binary log data from Apple's unified logging system (os_log), which is the primary logging mechanism in macOS since Yosemite. Unlike the plain-text /private/var/log/system.log, these binary logs capture high-fidelity, structured diagnostic data that can be queried using the `log` command (e.g., `log show --archive`). This directory is critical for forensic analysis of system events, crashes, and performance issues.

Answer

They are both plain-text log files used for system monitoring

Answer

The diagnostics directory contains compressed archives of system.log

Answer

These locations are remnants of third-party security software

Question 15

Which Windows Event ID is generated when a new service is installed on a system?

Accepted Answer

7045. Event ID 7045 is logged in the Windows System event log when a new service is installed on the system. This event is generated by the Service Control Manager (SCM) and records details such as the service name, binary path, service type, and start mode, making it a critical artifact for forensic analysis of unauthorized service installations.

Answer

4624

Answer

4648

Answer

4720