CHFI OS and Network Forensics Practice Test 7 — 15 Questions

Question 1

A forensic analyst examining a Windows machine finds a suspicious service named 'SrvMon' installed. The System event log shows Event ID 7045 at the time of compromise. What does this event indicate?

Accepted Answer

A service was installed. Event ID 7045 in the Windows System event log is specifically generated when a new service is installed on the system. The forensic analyst found a suspicious service named 'SrvMon', and the presence of this event at the time of compromise directly indicates that the service was installed, making option C correct.

Answer

A logon attempt failed

Answer

A user account was created

Answer

A scheduled task was created

Question 2

During a Linux forensic investigation, you find that the file /var/log/auth.log has been deleted. Which of the following artefacts would BEST help determine recent SSH login attempts?

Accepted Answer

Output of the 'last' command. The 'last' command reads the /var/log/wtmp binary log file, which records all login and logout events, including SSH sessions. Even if /var/log/auth.log is deleted, the wtmp file persists and provides a reliable record of recent SSH login attempts, making option D the best choice.

Answer

Contents of /etc/shadow

Answer

Bash history from /root/.bash_history

Answer

Cron job entries in /etc/crontab

Question 3

An analyst reviews Windows Registry for USB device usage history. Which registry hive and key contain the 'USBSTOR' key that logs unique serial numbers of connected USB drives?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key is located under HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR and logs each unique USB device by its serial number. This hive is part of the SYSTEM registry, which maintains device enumeration data used by the Plug and Play manager to track connected hardware. Forensic analysts examine this key to identify USB drive insertion history, including first and last connection timestamps.

Answer

HKLM\SAM\SAM\Domains\Account\Users

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Question 4

A network forensics analyst captures traffic and sees a series of TCP SYN packets sent to multiple ports on a target, with no corresponding SYN-ACK replies. What type of activity is MOST likely indicated?

Accepted Answer

A port scan reconnaissance. The observation of TCP SYN packets sent to multiple ports without any SYN-ACK replies indicates a port scan, specifically a SYN scan (half-open scan). In a SYN scan, the attacker sends a SYN packet to each port; if the port is open, the target responds with a SYN-ACK, but the attacker never completes the handshake. The absence of any SYN-ACK replies suggests that either all scanned ports are closed (RST responses would be expected) or the target is filtering traffic, but the pattern of multiple SYN packets to different ports is the hallmark of reconnaissance, not a denial-of-service attack.

Answer

A denial-of-service (DoS) flood

Answer

A man-in-the-middle attack

Answer

Normal web browsing traffic

Question 5

In Windows forensics, which artifact is a database of metadata about files and applications accessed by the user, used to populate the 'Recent Items' and 'Quick Access' lists?

Accepted Answer

Jumplists. Jumplists are the correct answer because they are a Windows artifact that stores metadata about recently accessed files and applications, directly populating the 'Recent Items' and 'Quick Access' lists in the taskbar and File Explorer. Each jumplist is a database file (e.g., .automaticDestinations-ms or .customDestinations-ms) containing entries with timestamps, file paths, and application IDs, making them a key source for forensic reconstruction of user activity.

Answer

Prefetch files

Answer

LNK files

Answer

ShellBags

Question 6

A forensic examiner finds a suspicious entry in the Linux file /etc/passwd: 'backdoor:x:0:0:root:/root:/bin/bash'. What is the MOST significant security issue with this entry?

Accepted Answer

The UID is 0, granting root privileges. The UID (user ID) of 0 is the root user identifier in Linux. Any account with UID 0 is granted the same privileges as the root user, regardless of the account name. This entry effectively creates a backdoor account with full administrative control over the system, bypassing normal authentication and accountability measures.

Answer

The entry has no password hash

Answer

The home directory is set to /root

Answer

The shell is /bin/bash

Question 7

During a Mac forensic investigation, you examine the unified log for process execution around the time of an incident. Which command-line tool is used to query the macOS unified log?

Accepted Answer

log. The `log` command is the native macOS tool for querying the unified log system, which consolidates kernel, driver, and application logs into a single, high-performance data store. It supports filtering by process, time range, and subsystem, making it essential for forensic timeline reconstruction on macOS. Unlike traditional syslog, the unified log uses a binary format that only `log` can efficiently parse.

Answer

journalctl

Answer

dmesg

Answer

syslog

Question 8

A forensic analyst finds multiple Prefetch files in C:\Windows\Prefetch with recent timestamps. What is the primary value of Prefetch files in an investigation?

Accepted Answer

They record the first and last execution times of applications. Prefetch files in Windows store metadata about application launches, including the first and last execution times. This allows forensic analysts to determine when a specific program was run, which is crucial for timeline analysis and identifying unauthorized or malicious software execution.

Answer

They store the user's web browsing history

Answer

They list all network connections made by the system

Answer

They contain the actual content of user documents

Question 9

A forensic tool outputs a timeline of file system events. The analyst needs to correlate registry modifications with file creation times. Which tool is specifically designed for super timeline creation from multiple sources?

Accepted Answer

Plaso. Plaso (log2timeline) is specifically designed to create super timelines by aggregating and correlating events from multiple sources, including file system metadata, registry hives, and event logs. It parses artifacts like NTFS $MFT, USN journal, and registry keys (e.g., NTUSER.DAT) to produce a unified timeline, enabling the analyst to correlate registry modifications with file creation times.

Answer

Autopsy

Answer

Volatility

Answer

Sleuth Kit

Question 10

An investigator finds a suspicious LNK file on a Windows desktop pointing to an executable in the Temp folder. What is the significance of LNK files in forensic analysis?

Accepted Answer

They provide evidence of file access and execution. LNK files (Windows shortcuts) contain metadata about the target file, including its path, creation/modification timestamps, and volume information. When a user double-clicks an LNK file, Windows follows the link to execute the target, so the presence of an LNK file pointing to an executable in the Temp folder is strong evidence that the executable was accessed or executed from that location. This is critical in forensic analysis for reconstructing user activity and identifying potential malware execution.

Answer

They store network share credentials in plaintext

Answer

They contain the full content of the target file

Answer

They are used exclusively for system files

Question 11

An analyst is reviewing a Linux system for signs of a rootkit. Which THREE of the following are common indicators of a rootkit infection? (Select THREE.)

Accepted Answer

Anomalies in the /proc filesystem. Option B is correct because a rootkit often hooks or hides processes, files, and network sockets by tampering with the kernel's virtual /proc filesystem, so discrepancies between /proc entries and tools like ps or ls, or missing PIDs, are a classic anomaly. Option D is correct because rootkits frequently install malicious loadable kernel modules (LKMs) to intercept syscalls and conceal their presence, so unexpected or unsigned modules in lsmod//proc/modules are a strong indicator. Option E is correct because rootkits commonly replace or trojanize core system binaries such as ls, ps, netstat, and top so they omit the attacker's processes and files, which can be detected via package verification (rpm -V, debsums) or checksum comparison. Option A is not a typical rootkit indicator, since incorrect permissions on /etc/passwd usually reflect misconfiguration or a separate privilege/account issue rather than kernel-level concealment. Option C is also not specific to rootkits, as a high volume of failed SSH logins indicates brute-force or credential-stuffing attempts, not the stealth mechanisms a rootkit employs.

Answer

Incorrect file permissions on /etc/passwd

Answer

Large number of failed SSH login attempts

Question 12

A network forensic investigator is analyzing traffic from a compromised web server. Which TWO artifacts are MOST likely to indicate the presence of a web shell? (Select TWO.)

Accepted Answer

Presence of a suspicious .aspx or .php file in web directories. Option C is correct because web shells are typically deployed as malicious script files (e.g., .aspx, .php, .jsp) placed in web-accessible directories, so finding an unexpected or suspicious script file there is a strong indicator of a web shell. Option D is correct because web shells are commonly invoked through HTTP POST requests to unusual or non-standard script paths, allowing attackers to send commands and receive output over the web channel. Options A, B, and E are not the most likely indicators: DNS queries to external domains, excessive SYN-ACK packets, and high ICMP traffic can reflect other activities such as command-and-control, scanning, or tunneling, but they are not specific artifacts of a web shell on a compromised web server.

Answer

Multiple DNS queries to external domains

Answer

Excessive SYN-ACK packets

Answer

High volume of ICMP traffic

Question 13

A security analyst reviews Windows Security event logs and finds Event ID 4625 with Logon Type 10. What does this indicate?

Accepted Answer

Failed remote interactive logon (e.g., RDP). Event ID 4625 with Logon Type 10 specifically indicates a failed Remote Interactive logon attempt, which is characteristic of Remote Desktop Protocol (RDP) connections. Logon Type 10 is defined in Windows security auditing as 'RemoteInteractive' and is triggered when an authentication attempt fails over a remote desktop session, typically using RDP (port 3389). This event is critical for detecting brute-force or unauthorized RDP access attempts.

Answer

Failed service logon attempt

Answer

Successful network logon

Answer

Successful local logon

Question 14

Which Windows Registry hive is primarily used to store user-specific application settings and recently accessed files?

Accepted Answer

NTUSER.DAT. NTUSER.DAT is the correct answer because it is the registry hive file that stores per-user settings, including application configurations and recently accessed files (e.g., MRU lists). When a user logs on, Windows loads NTUSER.DAT into HKEY_CURRENT_USER (HKCU), making it the primary repository for user-specific data.

Answer

HKU\.DEFAULT

Answer

HKLM\SYSTEM

Answer

HKLM\SAM

Question 15

During a Linux forensic investigation, you find that the /var/log/auth.log file contains log entries showing multiple 'Failed password for root' messages from a single IP address, followed by a 'Accepted password for root' entry. What is the MOST likely conclusion?

Accepted Answer

An attacker successfully brute-forced the root password. The sequence of multiple 'Failed password for root' entries followed by an 'Accepted password for root' entry from the same IP address is the classic signature of a successful brute-force attack against the root account. SSH authentication logs record each attempt, and a successful login after repeated failures indicates that the attacker guessed or cracked the password, not that a privilege escalation or lockout occurred.

Answer

The root user accidentally mistyped the password multiple times

Answer

The system was compromised via a privilege escalation exploit

Answer

The root account has been locked out due to multiple failures