CHFI OS and Network Forensics Practice Test 4 — 15 Questions

Question 1

A forensic analyst examining a Windows machine finds a suspicious service named 'SrvMon' installed. The System event log shows Event ID 7045 at the time of compromise. What does this event indicate?

Accepted Answer

A service was installed. Event ID 7045 indicates a new service was installed, which is a common persistence mechanism used by malware.

Answer

A logon attempt failed

Answer

A user account was created

Answer

A scheduled task was created

Question 2

During a Linux forensic investigation, you find that the file /var/log/auth.log has been deleted. Which of the following artefacts would BEST help determine recent SSH login attempts?

Accepted Answer

Output of the 'last' command. The 'last' command reads /var/log/wtmp, which records all logins and logouts, including SSH sessions.

Answer

Contents of /etc/shadow

Answer

Bash history from /root/.bash_history

Answer

Cron job entries in /etc/crontab

Question 3

An analyst reviews Windows Registry for USB device usage history. Which registry hive and key contain the 'USBSTOR' key that logs unique serial numbers of connected USB drives?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. USBSTOR is located under SYSTEM\CurrentControlSet\Enum\USBSTOR, which records USB storage device identifiers.

Answer

HKLM\SAM\SAM\Domains\Account\Users

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Question 4

A network forensics analyst captures traffic and sees a series of TCP SYN packets sent to multiple ports on a target, with no corresponding SYN-ACK replies. What type of activity is MOST likely indicated?

Accepted Answer

A port scan reconnaissance. A port scan sends SYN packets to various ports; if no SYN-ACK is received, the ports are likely filtered or closed, characteristic of a scan.

Answer

A denial-of-service (DoS) flood

Answer

A man-in-the-middle attack

Answer

Normal web browsing traffic

Question 5

In Windows forensics, which artifact is a database of metadata about files and applications accessed by the user, used to populate the 'Recent Items' and 'Quick Access' lists?

Accepted Answer

Jumplists. Jumplists contain recently accessed files and application-specific destinations, used for Quick Access and Recent Items.

Answer

Prefetch files

Answer

LNK files

Answer

ShellBags

Question 6

A forensic examiner finds a suspicious entry in the Linux file /etc/passwd: 'backdoor:x:0:0:root:/root:/bin/bash'. What is the MOST significant security issue with this entry?

Accepted Answer

The UID is 0, granting root privileges. A UID of 0 gives root privileges; the username 'backdoor' with UID 0 indicates a backdoor account with superuser access.

Answer

The entry has no password hash

Answer

The home directory is set to /root

Answer

The shell is /bin/bash

Question 7

A security analyst needs to examine network traffic for signs of a data exfiltration attempt. Which tool is specifically designed for deep packet inspection and can reconstruct TCP streams?

Accepted Answer

Wireshark. Wireshark is the primary tool for packet capture and analysis, including TCP stream reconstruction.

Answer

Tcpdump

Answer

Netstat

Answer

Nmap

Question 8

During a Mac forensic investigation, you examine the unified log for process execution around the time of an incident. Which command-line tool is used to query the macOS unified log?

Accepted Answer

log. The 'log' command is the native tool to query the unified logging system on macOS.

Answer

journalctl

Answer

dmesg

Answer

syslog

Question 9

A forensic analyst finds multiple Prefetch files in C:\Windows\Prefetch with recent timestamps. What is the primary value of Prefetch files in an investigation?

Accepted Answer

They record the first and last execution times of applications. Prefetch files contain the first run time, last run time, and run count of applications, plus loaded DLLs, useful for timeline analysis.

Answer

They store the user's web browsing history

Answer

They list all network connections made by the system

Answer

They contain the actual content of user documents

Question 10

In network forensics, which type of log is BEST for identifying all outbound connections from internal hosts to external IP addresses on specific ports?

Accepted Answer

Firewall logs. Firewall logs record allowed and denied traffic, including source/destination IP and port, ideal for tracking outbound connections.

Answer

IDS logs

Answer

Proxy logs

Answer

NetFlow logs

Question 11

A forensic tool outputs a timeline of file system events. The analyst needs to correlate registry modifications with file creation times. Which tool is specifically designed for super timeline creation from multiple sources?

Accepted Answer

Plaso. Plaso (log2timeline) is a timeline creation tool that aggregates data from various forensic artifacts into a super timeline.

Answer

Autopsy

Answer

Volatility

Answer

Sleuth Kit

Question 12

An investigator finds a suspicious LNK file on a Windows desktop pointing to an executable in the Temp folder. What is the significance of LNK files in forensic analysis?

Accepted Answer

They provide evidence of file access and execution. LNK files are shortcuts that contain metadata including target path, creation time, and sometimes volume information, indicating user activity.

Answer

They store network share credentials in plaintext

Answer

They contain the full content of the target file

Answer

They are used exclusively for system files

Question 13

A forensic analyst is investigating a Windows system for persistence mechanisms. Which TWO registry locations are commonly used by malware to achieve auto-start? (Select TWO.)

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Run keys under HKLM and HKCU are common autorun locations used by malware to start on boot or user login.

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKLM\SAM\SAM

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Question 14

An analyst is reviewing a Linux system for signs of a rootkit. Which THREE of the following are common indicators of a rootkit infection? (Select THREE.)

Accepted Answer

Anomalies in the /proc filesystem. Loadable kernel modules (LKM) are a common rootkit technique. Modified system binaries and hidden processes are also typical indicators.

Answer

Incorrect file permissions on /etc/passwd

Answer

Large number of failed SSH login attempts

Question 15

A network forensic investigator is analyzing traffic from a compromised web server. Which TWO artifacts are MOST likely to indicate the presence of a web shell? (Select TWO.)

Accepted Answer

Presence of a suspicious .aspx or .php file in web directories. Web shells are often uploaded as scripts and generate unusual HTTP requests; logs will show these patterns.

Answer

Multiple DNS queries to external domains

Answer

Excessive SYN-ACK packets

Answer

High volume of ICMP traffic