CHFI OS and Network Forensics Practice Test 7 — 15 Questions

Question 1

A forensic analyst is examining a Windows 10 system and finds suspicious activity. Which registry hive contains user-specific configuration data that can reveal evidence of recent file access through ShellBags, UserAssist, and MRU lists?

Accepted Answer

NTUSER.DAT. NTUSER.DAT is the user-specific registry hive loaded under HKCU, containing ShellBags, UserAssist, MostRecentlyUsed (MRU) lists, and other user activity artifacts. SAM stores local account hashes, SYSTEM stores system-wide config, and SOFTWARE stores installed applications info.

Answer

HKLM\SYSTEM

Answer

HKLM\SAM

Answer

HKLM\SOFTWARE

Question 2

During an incident response on a Linux server, you find the following entry in /var/log/auth.log: "Mar 10 12:34:56 server sshd[1234]: Failed password for root from 10.0.0.5 port 34567 ssh2". Which of the following is the BEST immediate action to prevent further unauthorized access?

Accepted Answer

Edit /etc/ssh/sshd_config to set PermitRootLogin no and PasswordAuthentication no, then restart sshd. The log shows a failed SSH login attempt for root from an external IP. The most effective immediate action is to change the SSH configuration to disable root login and key-based authentication only (PasswordAuthentication no), then restart the service. This blocks password guessing attacks on root.

Answer

Block the IP address 10.0.0.5 at the firewall

Answer

Delete the root user account

Answer

Change the root password to a complex password

Question 3

A security analyst is reviewing Windows Event Logs and notices multiple Event ID 4625 entries for a single user account within a short time frame. What does this most likely indicate?

Accepted Answer

A brute-force password guessing attack. Event ID 4625 indicates a failed logon attempt. Multiple such events for the same user in a short period strongly suggest a brute-force password guessing attack.

Answer

Successful user logins

Answer

Account creation events

Answer

Service installation

Question 4

A forensic analyst is investigating a Windows system for evidence of USB device usage. Which registry key is MOST useful for determining the first time a USB device was connected and its serial number?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR registry key under HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR contains subkeys for each USB device, with properties like serial number and first install date.

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellBags

Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USB

Question 5

During a forensic investigation of a Linux system, you need to determine which commands a user executed in their shell session. Which file would you examine to find this information?

Accepted Answer

/home/username/.bash_history. The bash_history file in the user's home directory (e.g., /home/username/.bash_history) records commands entered by the user in bash. Note that history may not be complete if the user opened multiple sessions or the file was cleared.

Answer

/var/log/auth.log

Answer

/etc/passwd

Answer

/var/log/syslog

Question 6

Which Windows Event ID is generated when a new service is installed on a system, and is often used by malware to establish persistence?

Accepted Answer

7045. Event ID 7045 logs the installation of a new service, including service name, image path, and start type. Malware often creates services to achieve persistence.

Answer

4624

Answer

4648

Answer

4720

Question 7

A forensic analyst is examining a Mac system for evidence of recent file access. Which artifact provides a timeline of file system events with high precision and is commonly analyzed using tools like mac_apt?

Accepted Answer

FSEvents. FSEvents (File System Events) on macOS records changes to the file system, including timestamps, and is stored in /.fseventsd. It is a primary artifact for timeline analysis on Mac.

Answer

bash_history

Answer

Unified Logging

Answer

.plist files

Question 8

A network analyst captures traffic and sees an HTTP request containing: GET /wp-content/uploads/evil.php?cmd=id HTTP/1.1. Which of the following is MOST likely occurring?

Accepted Answer

Webshell access. The request attempts to execute a command (id) via a PHP file in the uploads directory, indicating a webshell. Webshells allow attackers to execute commands on the server.

Answer

SQL injection attack

Answer

Cross-site scripting (XSS) attack

Answer

Directory traversal attack

Question 9

A forensic analyst is using Plaso (log2timeline) to create a super timeline from a compromised Windows system. Which of the following is the PRIMARY advantage of using Plaso over manual timeline creation?

Accepted Answer

It automatically correlates events from different sources and provides a unified timeline. Plaso automates the extraction and correlation of timestamps from multiple artifacts (registry, event logs, file system, etc.) into a unified timeline, saving time and reducing errors compared to manual extraction.

Answer

It can detect malware by signature scanning

Answer

It generates a timeline only from Windows Event Logs

Answer

It encrypts the timeline for secure storage

Question 10

Which tool is specifically designed for timeline analysis in digital forensics and is the command-line version of the log2timeline framework?

Accepted Answer

Plaso. Plaso (Python Log2Timeline) is the command-line tool for creating super timelines from various forensic artifacts.

Answer

Autopsy

Answer

Sleuth Kit

Answer

Wireshark

Question 11

During a forensic examination of a Windows 10 system, you find a file named "chrome_000001.jumplist" in the user's AppData directory. What does the presence of this file indicate?

Accepted Answer

The file stores recent items accessed through Chrome, such as downloaded files. Jump lists are created by Windows to show recently opened files for applications pinned to the taskbar or start menu. The file name indicates it is a jump list for Google Chrome, revealing recently accessed files or URLs within Chrome.

Answer

The file is a Chrome extension

Answer

The user has installed Chrome via a jump list installer

Answer

The file contains Chrome bookmarks

Question 12

A security analyst is reviewing firewall logs and notices repeated connection attempts from an internal IP to an external server on TCP port 4444. The internal host is a web server. What is the MOST likely explanation?

Accepted Answer

The web server has a reverse shell connection to a command-and-control server. Port 4444 is commonly associated with reverse shells (e.g., Metasploit default). A web server making outbound connections to an external server on port 4444 strongly suggests a reverse shell from the web server to a command-and-control (C2) server.

Answer

The web server is serving HTTPS traffic on port 4444

Answer

The web server is performing DNS queries

Answer

The web server is being scanned for open ports

Question 13

A forensic analyst is investigating a Windows system for evidence of malware persistence. Which TWO registry locations are commonly used by malware to automatically execute on system startup?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Services. Run keys (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) are common startup locations. The SAM hive stores password hashes, not persistence. Prefetch tracks program execution but does not cause auto-start. Services can be used for persistence but are not a registry key (they use subkeys under SYSTEM).

Answer

HKLM\SAM

Answer

C:\Windows\Prefetch

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellBags

Question 14

A security analyst is analyzing network traffic and sees the following: Source IP 10.0.0.1, Destination IP 203.0.113.5, TCP SYN flag set, destination port 445. The analyst suspects a worm propagation attempt. Which TWO additional pieces of evidence would strengthen this conclusion?

Accepted Answer

The packet size is exactly 66 bytes, identical to other similar packets. Worm propagation often scans many internal hosts on SMB port 445 (indicating lateral movement) and uses consistent payload sizes. A single SYN to an external IP on port 445 could be a normal file share connection. Internal scanning and similar packet sizes are indicative of automated worm behavior.

Answer

The source MAC address is from a well-known vendor

Answer

The packet contains a payload with the string "SMBv2"

Answer

The destination IP 203.0.113.5 is a known web server

Question 15

A forensic investigator is examining a Linux system compromised via a web application. Which THREE artifacts should the investigator prioritize to determine the attacker's entry point and post-exploitation activities?

Accepted Answer

/home/compromised_user/.bash_history. The web server logs (access.log) can show the initial exploit request. auth.log may show authentication events if credentials were used. bash_history can reveal commands executed after compromise. cron jobs are persistence mechanisms but not entry point. /etc/shadow stores password hashes, not attack details.

Answer

/etc/shadow

Answer

Cron job entries in /etc/crontab