CHFI OS and Network Forensics Practice Test 6 — 15 Questions

Question 1

Which TWO Windows Event IDs are associated with successful and failed logon events? (Select two.)

Accepted Answer

4625. Event ID 4624 is logged when a user successfully logs on to a Windows system, while Event ID 4625 is logged when a logon attempt fails. These are the standard security audit events for logon success and failure, respectively, and are essential for forensic analysis of authentication activity.

Answer

4720

Answer

7045

Answer

4648

Question 2

Which THREE of the following are common persistence mechanisms found in Linux systems? (Select three.)

Accepted Answer

SSH authorized_keys. SSH authorized_keys is a common persistence mechanism because an attacker can append their own public key to the ~/.ssh/authorized_keys file of a target user, allowing them to authenticate via SSH without a password. This grants persistent remote access even if the user changes their password, as the key pair remains valid until explicitly removed.

Answer

.bashrc in user home directories

Answer

/etc/passwd file modification

Question 3

Which TWO of the following are tools commonly used for network forensics analysis? (Select two.)

Accepted Answer

tcpdump. tcpdump is a command-line packet analyzer that captures and displays network traffic in real time, making it a core tool for network forensics. It allows investigators to capture raw packets at the interface level, filter by protocols (e.g., TCP, UDP, ICMP), and save captures to pcap files for later analysis. This direct packet-level visibility is essential for reconstructing network events, identifying malicious traffic, and correlating timestamps during incident response.

Answer

Autopsy

Answer

Volatility

Answer

dd

Question 4

A forensic analyst is examining a Windows 10 system and finds suspicious activity. Which registry hive contains user-specific configuration data that can reveal evidence of recent file access through ShellBags, UserAssist, and MRU lists?

Accepted Answer

NTUSER.DAT. The NTUSER.DAT file is the registry hive that stores user-specific configuration data for each user profile on a Windows 10 system. It contains the ShellBags keys (for folder view settings and recent folder access), UserAssist keys (tracking GUI-based program executions via the ROT13-encoded count and timestamp), and MRU (Most Recently Used) lists (for recently opened files and applications). These artifacts are critical for forensic analysis of user activity, and they are not stored in any of the HKLM hives, which are machine-wide.

Answer

HKLM\SYSTEM

Answer

HKLM\SAM

Answer

HKLM\SOFTWARE

Question 5

During an incident response on a Linux server, you find the following entry in /var/log/auth.log: "Mar 10 12:34:56 server sshd[1234]: Failed password for root from 10.0.0.5 port 34567 ssh2". Which of the following is the BEST immediate action to prevent further unauthorized access?

Accepted Answer

Edit /etc/ssh/sshd_config to set PermitRootLogin no and PasswordAuthentication no, then restart sshd. It directly addresses the two most common attack vectors for SSH brute-force attacks: disabling root login (PermitRootLogin no) and disabling password-based authentication (PasswordAuthentication no) in favor of key-based authentication. This configuration change, followed by restarting sshd, immediately stops password-based attacks against root, which is the account targeted in the log entry. Blocking the IP alone (Option A) is reactive and does not prevent the same attacker from using a different IP, while changing the password (Option D) does not prevent future brute-force attempts.

Answer

Block the IP address 10.0.0.5 at the firewall

Answer

Delete the root user account

Answer

Change the root password to a complex password

Question 6

A security analyst is reviewing Windows Event Logs and notices multiple Event ID 4625 entries for a single user account within a short time frame. What does this most likely indicate?

Accepted Answer

A brute-force password guessing attack. Event ID 4625 is the Windows security log event for a failed logon attempt. A high frequency of these events for the same user account within a short time frame is a classic indicator of an automated brute-force password guessing attack, where an attacker tries multiple passwords against a single account.

Answer

Successful user logins

Answer

Account creation events

Answer

Service installation

Question 7

During a forensic investigation of a Linux system, you need to determine which commands a user executed in their shell session. Which file would you examine to find this information?

Accepted Answer

/home/username/.bash_history. The .bash_history file in a user's home directory stores the command history for that user's interactive Bash shell sessions. By default, Bash appends each command to this file when the session ends, making it the primary source for reconstructing a user's executed commands during forensic analysis.

Answer

/var/log/auth.log

Answer

/etc/passwd

Answer

/var/log/syslog

Question 8

Which Windows Event ID is generated when a new service is installed on a system, and is often used by malware to establish persistence?

Accepted Answer

7045. Event ID 7045 is generated by the Windows Service Control Manager (SCM) when a new service is installed on the system. Malware often uses this event to establish persistence by creating a service that automatically starts, and forensic analysts look for 7045 events to detect unauthorized service installations.

Answer

4624

Answer

4648

Answer

4720

Question 9

A forensic analyst is examining a Mac system for evidence of recent file access. Which artifact provides a timeline of file system events with high precision and is commonly analyzed using tools like mac_apt?

Accepted Answer

FSEvents. FSEvents (Option D) is the correct answer because it is a macOS kernel-level mechanism that logs file system events (e.g., creation, modification, deletion) with nanosecond precision. Tools like mac_apt parse the FSEventsd database to reconstruct a high-resolution timeline of user and system file activity, making it ideal for forensic timeline analysis.

Answer

bash_history

Answer

Unified Logging

Answer

.plist files

Question 10

A network analyst captures traffic and sees an HTTP request containing: GET /wp-content/uploads/evil.php?cmd=id HTTP/1.1. Which of the following is MOST likely occurring?

Accepted Answer

Webshell access. The HTTP request `GET /wp-content/uploads/evil.php?cmd=id HTTP/1.1` indicates that the attacker is accessing a PHP file (`evil.php`) in the WordPress uploads directory and passing a command (`cmd=id`) to it. This is a classic indicator of a webshell — a malicious script uploaded to the server that allows remote command execution. The `id` command is a common Unix command used to verify the current user context, confirming the attacker has achieved interactive shell-like access.

Answer

SQL injection attack

Answer

Cross-site scripting (XSS) attack

Answer

Directory traversal attack

Question 11

A forensic analyst is using Plaso (log2timeline) to create a super timeline from a compromised Windows system. Which of the following is the PRIMARY advantage of using Plaso over manual timeline creation?

Accepted Answer

It automatically correlates events from different sources and provides a unified timeline. Plaso (log2timeline) is designed to automatically parse and correlate artifacts from multiple sources—such as Windows Event Logs, Registry hives, Prefetch files, and USN journals—into a single, unified super timeline. This eliminates the need for manual correlation across disparate log files, which is error-prone and time-consuming, making automated correlation the primary advantage over manual timeline creation.

Answer

It can detect malware by signature scanning

Answer

It generates a timeline only from Windows Event Logs

Answer

It encrypts the timeline for secure storage

Question 12

Which tool is specifically designed for timeline analysis in digital forensics and is the command-line version of the log2timeline framework?

Accepted Answer

Plaso. Plaso (Python Log2Timeline) is the command-line version of the log2timeline framework, specifically engineered for super timeline creation and timeline analysis in digital forensics. It parses multiple log and artifact sources (e.g., Windows Event Logs, Prefetch, Registry hives) into a unified, high-performance timeline database (SQLite or Elasticsearch), enabling examiners to correlate events across time. This makes it the direct answer to a question asking for the CLI tool derived from the log2timeline framework.

Answer

Autopsy

Answer

Sleuth Kit

Answer

Wireshark

Question 13

During a forensic examination of a Windows 10 system, you find a file named "chrome_000001.jumplist" in the user's AppData directory. What does the presence of this file indicate?

Accepted Answer

The file stores recent items accessed through Chrome, such as downloaded files. Jump lists in Windows store recently accessed items for applications pinned to the taskbar or recently used. The file 'chrome_000001.jumplist' is a Windows-generated binary file that logs recent documents, downloads, or URLs opened via Google Chrome. Its presence indicates the user has recently accessed files or links through Chrome, making D correct.

Answer

The file is a Chrome extension

Answer

The user has installed Chrome via a jump list installer

Answer

The file contains Chrome bookmarks

Question 14

A security analyst is analyzing network traffic and sees the following: Source IP 10.0.0.1, Destination IP 203.0.113.5, TCP SYN flag set, destination port 445. The analyst suspects a worm propagation attempt. Which TWO additional pieces of evidence would strengthen this conclusion?

Accepted Answer

The packet size is exactly 66 bytes, identical to other similar packets. A is correct because worm propagation often uses consistent packet sizes due to hardcoded exploit payloads. A 66-byte TCP SYN packet (40 bytes IP header + 20 bytes TCP header + 6 bytes optional timestamp) is typical for a crafted SYN flood or worm scan, and identical sizes across multiple packets indicate automated behavior rather than normal variation.

Answer

The source MAC address is from a well-known vendor

Answer

The packet contains a payload with the string "SMBv2"

Answer

The destination IP 203.0.113.5 is a known web server

Question 15

A forensic investigator is examining a Linux system compromised via a web application. Which THREE artifacts should the investigator prioritize to determine the attacker's entry point and post-exploitation activities?

Accepted Answer

/home/compromised_user/.bash_history. The .bash_history file (A) records commands executed by the user, which can reveal the attacker's post-exploitation actions such as privilege escalation attempts, lateral movement, or data exfiltration. /var/log/auth.log (C) logs authentication events (e.g., SSH logins, sudo usage), helping identify the entry point and any brute-force or credential abuse. Web server access logs (E) capture HTTP requests, including the initial exploit payload (e.g., SQL injection, LFI), directly showing how the attacker compromised the web application.

Answer

/etc/shadow

Answer

Cron job entries in /etc/crontab