CHFI OS and Network Forensics Practice Test 8 — 15 Questions

Question 1

A network forensics analyst captures traffic from a suspected data exfiltration. In Wireshark, filtering for DNS queries containing a long subdomain with base64-encoded text suggests which technique?

Accepted Answer

DNS tunneling. DNS tunneling encodes data (often base64) into DNS query subdomains to bypass network controls and exfiltrate information. Wireshark filtering for unusually long DNS queries with encoded text directly reveals this technique, as legitimate DNS queries rarely contain such payloads.

Answer

DNS hijacking

Answer

DNS poisoning

Answer

DNS amplification

Question 2

Which Windows Registry hive contains user-specific configuration such as MRU lists and UserAssist artifacts?

Accepted Answer

NTUSER.DAT. The NTUSER.DAT file is the registry hive that stores per-user configuration settings, including MRU (Most Recently Used) lists and UserAssist artifacts. When a user logs into a Windows system, this hive is loaded into HKEY_CURRENT_USER (HKCU), making it the primary source for user-specific forensic artifacts such as executed program traces and file access history.

Answer

HKLM\SAM

Answer

SYSTEM

Answer

HKLM\System

Question 3

A Linux system is suspected of being used as a pivot point. An analyst checks /proc/[pid]/fd/ and sees open file descriptors pointing to sockets. Which command would BEST determine the remote connections associated with these sockets?

Accepted Answer

lsof -i. The `lsof -i` command lists open network sockets and their associated processes, including remote IP addresses and ports. Since the analyst already knows the PID from `/proc/[pid]/fd/`, `lsof -i` can directly map the socket file descriptors to remote connections, making it the best choice for identifying pivot points.

Answer

netstat -anp

Answer

cat /proc/net/tcp

Answer

ls -la /proc/[pid]/fd/

Question 4

An analyst identifies an unknown binary running on a Linux server. Which /proc filesystem entry would provide the command-line arguments used to start the process?

Accepted Answer

/proc/[pid]/cmdline. /proc/[pid]/cmdline contains the exact command-line arguments used to start the process, stored as null-separated strings. This allows an analyst to see how the binary was invoked, including any flags or parameters, which is critical for identifying malicious or suspicious behavior.

Answer

/proc/[pid]/maps

Answer

/proc/[pid]/status

Answer

/proc/[pid]/environ

Question 5

In a macOS forensic investigation, which log system stores high-level events such as application launches and authentication attempts in a binary format, and can be queried using the 'log' command?

Accepted Answer

Unified logging. Unified logging is the correct answer because macOS stores high-level events like application launches and authentication attempts in a binary format within the unified log system (stored in /var/db/diagnostics/ and /var/db/uuidtext/). The 'log' command is the native tool to query these logs, using predicates and options such as 'log show' or 'log stream', making it the only option that matches both the binary format and the query method described.

Answer

system.log

Answer

Audit log

Answer

FSEvents

Question 6

A security team detects exfiltration via HTTP POST requests to a suspicious domain. Which network forensic technique would BEST identify the data being sent in these requests?

Accepted Answer

Wireshark packet capture with HTTP follow stream. Wireshark packet capture with HTTP follow stream allows the investigator to reassemble the full HTTP conversation, including the body of POST requests. By following the TCP stream, the exact payload (e.g., exfiltrated data) is reconstructed in plain text, making it the best technique to identify the data being sent. This method directly captures and decodes the application-layer content, unlike log-based or flow-based analysis.

Answer

Firewall log review

Answer

IDS alert correlation

Answer

NetFlow analysis

Question 7

During a forensic examination of a compromised Windows server, you find a registry key under HKLM\SYSTEM\CurrentControlSet\Services that points to a malicious DLL. Which event ID would have been generated when this service was installed?

Accepted Answer

7045. Event ID 7045 is logged in the System event log when a new service is installed on a Windows system. This event captures the service name, binary path, and service type, making it the primary forensic artifact for identifying a malicious DLL registered as a service under HKLM\SYSTEM\CurrentControlSet\Services.

Answer

4648

Answer

4720

Answer

4624

Question 8

A Linux investigator wants to see all commands run by a user from the bash shell. Which file should be examined?

Accepted Answer

~/.bash_history. The ~/.bash_history file stores the command history for each user's bash shell session. When a user runs commands in bash, they are appended to this file (typically in the user's home directory) unless history logging is disabled. Examining this file allows an investigator to see the exact commands executed by that specific user from the bash shell.

Answer

/etc/passwd

Answer

/var/log/auth.log

Answer

/var/log/syslog

Question 9

A forensic analyst is examining a Windows system for evidence of USB device usage. Which TWO registry locations are known to store USB device history?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. A is correct because the USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum stores a persistent list of all USB mass storage devices that have been connected to the system, including their vendor IDs, product IDs, and serial numbers. This key is populated by the Windows Plug and Play manager when a USB device is first enumerated and remains even after the device is removed, making it a primary source for USB device history.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Prefetch

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKLM\SAM\SAM\Domains\Account\Users

Question 10

A security analyst is investigating a potential webshell on an IIS server. Which THREE artifacts are commonly associated with webshell presence?

Accepted Answer

Presence of encoded scripts in the web application directory. Webshells often use obfuscation or encoding (e.g., Base64, hex, or custom encoding) to evade signature-based detection. The presence of encoded scripts in the web application directory indicates an attacker has placed a malicious file that can decode and execute commands, a hallmark of webshell persistence on IIS.

Answer

Increase in NetFlow traffic to a known good update server

Answer

Event ID 4624 logon events from the service account

Question 11

An analyst is reviewing firewall logs and sees repeated outbound connections from an internal host to a known malicious IP on port 443. Which TWO network forensic data sources would BEST help determine if data exfiltration occurred?

Accepted Answer

Full packet capture (PCAP) of the sessions. Full packet capture (PCAP) of the sessions (B) is correct because it provides the complete raw network traffic, including payload data, for the outbound connections on port 443. By analyzing the PCAP, an analyst can reconstruct the TCP streams and inspect the actual content transmitted, such as files or commands, which is essential for confirming data exfiltration. This is the most definitive source for verifying whether sensitive data left the network.

Answer

Network flow records showing packet sizes and counts

Answer

IDS alerts for signatures

Answer

Windows security event logs

Question 12

A security analyst reviews Windows Event Logs and sees Event ID 4625 multiple times for a single user account from a remote IP address within a short time frame. What is the MOST likely interpretation?

Accepted Answer

An attacker is attempting to brute-force the user's password. Event ID 4625 indicates a failed logon attempt. Multiple occurrences for the same user from a single remote IP within a short timeframe is the classic signature of a brute-force attack, where an attacker systematically tries different passwords against that account.

Answer

The user successfully logged on from multiple locations

Answer

The system is experiencing a denial-of-service attack

Answer

A service installed itself on the system

Question 13

During a forensic investigation, you find a file named ntuser.dat.LOG1 in a user's profile directory. What is the primary purpose of this file?

Accepted Answer

It logs changes to the user's registry hive for recovery purposes. The ntuser.dat.LOG1 file is a transactional log file used by the Windows registry to record changes made to the corresponding user's registry hive (ntuser.dat). Its primary purpose is to ensure data integrity and enable recovery of the hive in case of a system crash or power failure during a write operation, by allowing the registry to replay or roll back incomplete transactions.

Answer

It contains the user's Internet browsing history

Answer

It is a backup copy of the user's registry hive

Answer

It stores the user's recently accessed files

Question 14

A Linux system administrator notices unusual outbound connections from a server. Which of the following commands would MOST effectively capture a list of all current network connections along with the associated process IDs?

Accepted Answer

sudo ss -tunap. The `ss -tunap` command displays all TCP (`-t`), UDP (`-u`), and non-listening (`-n` for numeric, `-a` for all) sockets along with the associated process IDs (`-p`). This directly meets the requirement to capture current network connections and their PIDs for forensic analysis of unusual outbound traffic.

Answer

sudo iptables -L

Answer

sudo lsmod

Answer

sudo ifconfig -a

Question 15

A forensic analyst is investigating a Windows 10 system and needs to determine if a USB device was ever connected. Which registry key would provide a comprehensive list of USB devices that have been attached, including the first and last connection times?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum stores detailed information about USB mass storage devices that have been connected to the system, including the first and last connection timestamps in the Properties subkeys (e.g., {a8b865dd-2e3d-4094-ad97-e593a70c75d6}). This is the definitive location for forensic analysts to enumerate all attached USB storage devices and their connection history on Windows 10.

Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USB

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles