CHFI OS and Network Forensics Practice Test 6 — 15 Questions

Question 1

A forensic analyst finds a file with the .plist extension on a Mac system. What type of artifact is this?

Accepted Answer

Property list file. The .plist extension stands for 'property list', a structured data file used by macOS and iOS applications to store serialized objects like configuration settings, user preferences, and application state. These files are XML or binary-encoded and are a key artifact in forensic analysis for recovering user activity, application usage, and system configuration. Option D is correct because .plist files are explicitly defined as property list files in Apple's developer documentation.

Answer

Log file

Answer

Executable binary

Answer

Email database

Question 2

During a forensic analysis of a compromised Linux system, you notice that the /proc filesystem contains a suspicious entry /proc/12345/exe pointing to /tmp/.hidden/malware. What conclusion can you draw?

Accepted Answer

A process with PID 12345 is running the malware. The /proc filesystem is a virtual filesystem that provides process information. The entry /proc/12345/exe is a symbolic link pointing to the executable file that started the process with PID 12345. Since this link exists and points to /tmp/.hidden/malware, it confirms that a process with PID 12345 is currently running that malware binary.

Answer

The system was rebooted recently

Answer

The malware is a kernel module

Answer

The malware was executed via a cron job

Question 3

Which TWO Windows Event IDs are associated with successful logon or explicit credential usage? (Choose TWO.)

Accepted Answer

4648. Event ID 4624 [CORRECT] is logged in the Windows Security log when a logon attempt succeeds, recording details such as logon type, account name, and authentication package, so it directly matches the 'successful logon' part of the question. Event ID 4648 [CORRECT] is generated when a process attempts an explicit logon using credentials other than those of the current logged-on user (for example, RunAs or passing alternate credentials), which matches the 'explicit credential usage' part. By contrast, 4720 is logged when a new user account is created, 4625 records a failed logon attempt, and 7045 is a System log event indicating a new service was installed — none of these represent a successful logon or explicit credential use.

Answer

4720

Answer

4625

Answer

7045

Question 4

Which THREE of the following are commonly used for persistence on a Windows system? (Choose THREE.)

Accepted Answer

Registry Run keys. Registry Run keys (B) are a classic Windows persistence mechanism because entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Run or HKLM\...\Run are automatically executed at user logon or system startup. Service installations (C) provide persistence by registering a service with the Service Control Manager (e.g., via sc.exe create or New-Service), allowing malicious code to run at boot under a privileged context. Scheduled tasks (E) persist by creating a task through schtasks.exe or the Task Scheduler COM API that triggers execution at logon, startup, or on a schedule. LNK files (A) are shortcut files that can execute payloads when clicked but are not an automatic persistence mechanism by themselves, and Prefetch files (D) are forensic artifacts generated by the Windows prefetcher to speed up application launches, not a persistence technique.

Answer

LNK files

Answer

Prefetch files

Question 5

In Linux forensics, an investigator examines /var/log/auth.log and finds repeated entries of "Failed password for root from 10.0.0.5 port 22 ssh2". Which type of attack is most likely indicated?

Accepted Answer

Brute force attack on SSH. Repeated 'Failed password for root' entries in /var/log/auth.log indicate multiple authentication attempts against the SSH service. This pattern is characteristic of a brute force attack, where an attacker systematically tries many passwords to gain unauthorized access to the root account via SSH.

Answer

DNS cache poisoning attack

Answer

SQL injection attack

Answer

ARP spoofing attack

Question 6

A security analyst reviews the following Windows Event log entry: Event ID 4648 with logon type 3, subject user 'CONTOSO\admin', target server 'FS01', target user 'CONTOSO\backupadmin'. What does this event indicate?

Accepted Answer

An explicit credential logon was performed to access FS01 using the backupadmin account. Event ID 4648 with logon type 3 indicates a network logon where explicit credentials were supplied. The subject user 'CONTOSO\admin' attempted to access the target server 'FS01' using the target user 'CONTOSO\backupadmin' account, meaning the admin explicitly provided backupadmin's credentials for that network connection, rather than using their own.

Answer

A user account was created for backupadmin on FS01

Answer

A service was installed under the backupadmin account

Answer

The backupadmin account locked out due to multiple failed attempts

Question 7

In network forensics, an analyst captures traffic and sees a large number of ICMP echo requests from 10.0.0.1 to 10.0.0.2 with varying payload sizes. What is the most likely scenario?

Accepted Answer

A DoS attack using ICMP floods. The scenario describes a single source sending a large number of ICMP echo requests to a single destination with varying payload sizes. This is characteristic of an ICMP flood attack, a type of DoS attack where the attacker overwhelms the target with echo requests, consuming bandwidth and processing resources. The varying payload sizes may be an attempt to evade simple packet filters or to maximize resource consumption. In contrast, a ping sweep would involve sending requests to multiple destinations to discover live hosts, not a sustained high-volume stream to one host. Therefore, this is most likely a DoS attack, not reconnaissance.

Answer

Network reconnaissance (ping sweep)

Answer

A man-in-the-middle attack

Answer

A DNS amplification attack

Question 8

An incident responder finds a suspicious LNK file in a user's Startup folder on a Windows system. The LNK file's target is "C:\Windows\System32\rundll32.exe" with a command-line argument "javascript:" followed by encoded text. What is the most likely purpose of this shortcut?

Accepted Answer

A malicious persistence mechanism to execute payload via script. The LNK file targets rundll32.exe with a JavaScript command-line argument, which is a known technique for executing arbitrary script code without writing a traditional executable to disk. This is commonly used by malware to establish persistence by placing the shortcut in the Startup folder, ensuring the script runs each time the user logs in.

Answer

A shortcut to a network resource that failed

Answer

Legitimate update mechanism for Microsoft Office

Answer

A user-created automation script for daily tasks

Question 9

A forensic examiner is analyzing a compromised Linux server and notices that /etc/cron.daily contains a script named 'sysupdate.sh' that runs a base64-encoded command. Which persistence mechanism is being used?

Accepted Answer

Cron job for daily execution. The presence of a script named 'sysupdate.sh' inside /etc/cron.daily indicates that the system's cron daemon is configured to execute this script once per day. Cron jobs are a standard Linux persistence mechanism, and placing a script in /etc/cron.daily ensures it runs automatically on a daily schedule, making option B correct.

Answer

LD_PRELOAD library injection

Answer

Systemd service

Answer

SSH authorized_keys backdoor

Question 10

Which Wireshark filter should an analyst use to display only TCP packets that have the SYN flag set and the ACK flag not set?

Accepted Answer

tcp.flags.syn == 1 and tcp.flags.ack == 0. The filter `tcp.flags.syn == 1 and tcp.flags.ack == 0` uses the logical AND operator to require that the SYN flag is set (value 1) and the ACK flag is not set (value 0). This precisely matches the condition for a TCP SYN packet that is not part of a SYN-ACK handshake response, which is exactly what the analyst needs to isolate.

Answer

tcp.flags.syn == 1 or tcp.flags.ack == 0

Answer

tcp.flags.syn == 1

Answer

tcp.flags == 0x002

Question 11

An analyst reviews proxy logs and sees repeated requests to a known malicious domain from multiple internal hosts, each using a different User-Agent string. The requests are all GET requests for /images/icon.png. What technique is most likely being used to evade detection?

Accepted Answer

User-Agent randomization. The repeated GET requests for the same resource (/images/icon.png) from multiple internal hosts, each with a different User-Agent string, is a classic indicator of User-Agent randomization. This technique is used by malware to evade signature-based detection that relies on static User-Agent values, making the traffic appear to originate from diverse browsers or devices.

Answer

HTTPS tunneling

Answer

IP spoofing

Answer

Domain generation algorithm (DGA)

Question 12

Which Windows Event ID is generated when a service is installed on a system?

Accepted Answer

7045. Event ID 7045 is logged in the Windows System event log when a new service is installed on the system. This event records the service name, image path, service type, and start mode, making it a critical artifact for forensic investigators tracking unauthorized service installations.

Answer

4624

Answer

4688

Answer

4720

Question 13

Which TWO of the following are valid artifacts for determining program execution on a Windows system? (Select TWO.)

Accepted Answer

Jump Lists. Jump Lists (C) are valid artifacts because they are stored per-user in the AutomaticDestinations and CustomDestinations folders under %AppData%\Microsoft\Windows\Recent, and they record recently or frequently accessed files and applications, providing direct evidence of program execution. Prefetch files (D) are also valid because Windows creates a .pf file in C:\Windows\Prefetch for each executed application, containing the executable name, run count, and last-run timestamps, which directly demonstrates program execution. Pagefile.sys (A) is a virtual memory swap file, not an execution artifact, and System Restore points (B) are snapshots of system state used for rollback rather than proof of program execution. Windows Error Reporting logs (E) record crash and error telemetry, so they may indicate a program ran but are not a reliable or standard artifact for determining execution.

Answer

Pagefile.sys

Answer

System Restore points

Answer

Windows Error Reporting logs

Question 14

Which THREE of the following are common indicators of a web shell on a compromised web server? (Select THREE.)

Accepted Answer

Files with obfuscated code (e.g., base64 encoded strings). Option B is correct because web shells are frequently hidden by obfuscating their PHP/JSP/ASP code with base64-encoded strings, gzinflate, eval, or similar encoding tricks to evade signature-based detection. Option C is correct because attackers commonly drop web shell files into writable, web-accessible directories such as /uploads or /images and set execute permissions so the web server can run them via HTTP. Option E is correct because a web shell typically receives commands through HTTP POST requests carrying unusually large or repeated payloads to a single script, which is a strong behavioral indicator in access logs. Option A is not a reliable indicator, since .htaccess files with rewrite rules are a normal, legitimate part of Apache configuration and are used for many benign purposes. Option D is not a reliable indicator either, because a high number of 404 errors usually reflects broken links, scanning noise, or misconfiguration rather than a web shell specifically.

Answer

Presence of .htaccess files with rewrite rules

Answer

High number of 404 errors in access logs

Question 15

Which TWO of the following tools are primarily used for timeline analysis in digital forensics? (Select TWO.)

Accepted Answer

The Sleuth Kit (mactime). The Sleuth Kit's mactime tool (option B) is correct because it builds a bodyfile of MAC times (modified, accessed, changed, and created timestamps) from file system metadata and renders it into a chronological timeline, which is the core of timeline analysis in digital forensics. Plaso (option D) is also correct because it is a Python-based engine that parses many artifact types and, via its log2timeline/psort components, produces a super-timeline correlating events across sources, making it a primary timeline analysis tool. Autopsy (option C) is a full forensic platform that can display timelines, but it is not primarily a timeline analysis tool in the sense of the dedicated mactime and Plaso utilities. Nmap (option A) is a network discovery and port-scanning tool, and Wireshark (option E) is a packet capture and protocol analyzer; neither is designed for building forensic event timelines.

Answer

Nmap

Answer

Autopsy

Answer

Wireshark