CHFI OS and Network Forensics Practice Test 8 — 15 Questions

Question 1

Which tool is commonly used for timeline analysis in digital forensics, allowing examiners to parse and correlate timestamps from various artifacts?

Accepted Answer

log2timeline. log2timeline (now part of the Plaso framework) is the de facto tool for timeline analysis in digital forensics. It parses a wide range of artifacts (e.g., $MFT, $UsnJrnl, Prefetch, Registry hives, event logs) and correlates their timestamps into a unified, super-timeline, enabling examiners to reconstruct system activity chronologically.

Answer

Sleuth Kit

Answer

Nmap

Answer

Wireshark

Question 2

In Windows forensics, which artifact is used to track recently executed programs on a per-user basis?

Accepted Answer

UserAssist. UserAssist is a Windows registry key (under NTUSER.DAT) that records the execution count and last execution time of GUI-based programs for each user. It is specifically designed to track recently executed programs on a per-user basis, making it the correct artifact for this forensic question.

Answer

Jump lists

Answer

ShellBags

Answer

Prefetch files

Question 3

A network forensic analyst captures packets and sees a TCP SYN packet sent to port 80, followed by a SYN-ACK, then an ACK, and then an HTTP GET request. What can be concluded?

Accepted Answer

The TCP connection was successfully established. The TCP three-way handshake (SYN, SYN-ACK, ACK) completes successfully, establishing a connection. The subsequent HTTP GET request confirms the connection is fully open and usable for application-layer data transfer. This is the standard sequence for a normal TCP connection establishment.

Answer

The session was hijacked after the handshake

Answer

A TCP half-open scan was performed

Answer

The connection was refused by the server

Question 4

During a forensic examination of a macOS system, you find a file at /private/var/log/system.log and also notice a directory /private/var/db/diagnostics/. What is the significance of these locations?

Accepted Answer

The diagnostics directory contains binary log data from the unified logging system. /private/var/db/diagnostics/ stores binary log data from Apple's unified logging system (os_log), which is the primary logging mechanism in macOS since Yosemite. Unlike the plain-text /private/var/log/system.log, these binary logs capture high-fidelity, structured diagnostic data that can be queried using the `log` command (e.g., `log show --archive`). This directory is critical for forensic analysis of system events, crashes, and performance issues.

Answer

They are both plain-text log files used for system monitoring

Answer

The diagnostics directory contains compressed archives of system.log

Answer

These locations are remnants of third-party security software

Question 5

Which Windows Event ID is generated when a new service is installed on a system?

Accepted Answer

7045. Event ID 7045 is logged in the Windows System event log when a new service is installed on the system. This event is generated by the Service Control Manager (SCM) and records details such as the service name, binary path, service type, and start mode, making it a critical artifact for forensic analysis of unauthorized service installations.

Answer

4624

Answer

4648

Answer

4720

Question 6

A security analyst is investigating a potential intrusion and finds a webshell on a Linux web server. Which of the following logs would be MOST useful to determine how the webshell was uploaded?

Accepted Answer

/var/log/apache2/access.log. The Apache access log (/var/log/apache2/access.log) records every HTTP request made to the web server, including the method (e.g., POST), URI, source IP, and user-agent. A webshell is typically uploaded via a file upload vulnerability or a crafted HTTP request (e.g., PUT or POST with multipart/form-data), so the access log will show the exact request that transferred the malicious file to the server, making it the most useful for determining the upload vector.

Answer

/var/log/syslog

Answer

/var/log/auth.log

Answer

/var/log/kern.log

Question 7

In Windows registry forensics, which key is examined to identify USB devices that were connected to the system?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum contains a subkey for each USB mass storage device that has ever been connected to the system, recording the device's serial number, class, and instance ID. This is the primary forensic artifact for identifying USB device connection history because the system enumerates and persists these entries when a USB storage device is first plugged in.

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKLM\SAM\SAM\Domains\Account\Users

Question 8

A forensic examiner is analyzing a compromised Linux system and finds a suspicious cron job in /var/spool/cron/crontabs/root that executes a script every hour. The script is located in /tmp/.hidden/update.sh. What is the BEST next step?

Accepted Answer

Capture the script for analysis and preserve the cron entry as evidence. The cron job entry in /var/spool/cron/crontabs/root and the associated script in /tmp/.hidden/update.sh are critical pieces of evidence. The best next step is to capture the script for malware analysis and preserve the cron entry (e.g., by making a forensic copy of the file and its metadata) to maintain the integrity of the evidence chain. Deleting or rebooting would destroy volatile data and potentially alert the attacker, while running the script without proper containment could cause further compromise.

Answer

Reboot the system to clear the cron job from memory

Answer

Delete the cron job immediately to prevent further damage

Answer

Run the script in a sandbox to determine its functionality

Question 9

Which network forensic technique involves analyzing the flow of network traffic to identify patterns and anomalies, often using tools like SiLK or nfdump?

Accepted Answer

NetFlow analysis. NetFlow analysis is the correct technique because it focuses on collecting and analyzing IP traffic flow metadata (e.g., source/destination IPs, ports, protocols, packet counts) to detect patterns and anomalies. Tools like SiLK and nfdump are specifically designed to process NetFlow data, making this the precise match for the question's description.

Answer

Port scanning

Answer

Signature-based detection

Answer

Deep packet inspection

Question 10

Which THREE of the following are indicators of a web shell on a web server? (Select three.)

Accepted Answer

Unexpected file modifications in web directories, especially .php, .asp, or .jsp files. Option A is correct because web shells are typically dropped as script files in web-accessible directories, so unexpected creation or modification of .php, .asp, or .jsp files is a strong indicator of compromise. Option B is correct because a web shell often executes OS commands, causing processes such as cmd.exe on Windows or /bin/bash on Linux to run under the web server's service account (e.g., www-data, apache, or IIS APPPOOL), which is abnormal for normal web serving. Option E is correct because web shells commonly accept commands via HTTP parameters like ?cmd=whoami, so atypical requests embedding system commands in URLs or POST bodies are a direct sign of web shell activity. Option C is not correct because a rise in 404 errors from directory traversal attempts indicates scanning or probing, not necessarily an installed web shell. Option D is not correct because regular successful logins from multiple IP addresses may indicate credential sharing or other account misuse, but it is not a specific indicator of a web shell on the server.

Answer

An increase in 404 errors due to directory traversal attempts

Answer

Regular successful logins from multiple IP addresses

Question 11

Which TWO of the following are persistence mechanisms commonly found in Windows forensics? (Select two.)

Accepted Answer

Scheduled Tasks. Scheduled Tasks (C) are a well-known Windows persistence mechanism because an attacker can register a task via schtasks.exe or the Task Scheduler that launches malware at logon, on a schedule, or on system events, and these tasks survive reboots. Registry Run keys (E), such as HKLM\Software\Microsoft\Windows\CurrentVersion\Run and HKCU equivalents, are classic autostart locations that execute listed programs at user logon, making them a common persistence technique. By contrast, Jump lists (A) are artifacts recording recently accessed files and applications for forensic reconstruction, not autostart mechanisms. ShellBags (B) store folder view settings and window preferences in the registry to show user navigation history, and Prefetch files (D) are performance artifacts in C:\Windows\Prefetch that record executed program traces, neither of which causes programs to run automatically at startup.

Answer

Jump lists

Answer

ShellBags

Answer

Prefetch files

Question 12

A security analyst is reviewing Windows Security Event Logs and notices multiple Event ID 4625 entries for a single user account within a short time frame. What does this MOST likely indicate?

Accepted Answer

Brute-force password guessing attack. Event ID 4625 indicates a failed logon attempt. Multiple failures in a short time suggest a brute-force attack against the user account.

Answer

Service installation

Answer

Account lockout policy change

Answer

Successful account logon

Question 13

A forensic analyst is examining a Windows 10 system for evidence of USB device usage. Which registry hive and key path should she check to find a list of USB devices that have been connected to the system?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum stores the device instance IDs and class GUIDs for every USB mass storage device that has ever been connected to the system. This is the primary forensic artifact for enumerating historical USB device attachments on Windows 10.

Answer

HKLM\SAM\SAM\Domains\Account\Users

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

NTUSER.DAT\Software\Microsoft\Windows\ShellNoRoam\BagMRU

Question 14

A SOC analyst is analyzing a packet capture from a network where an internal host communicated with a known malicious IP. The analyst uses Wireshark and applies a display filter to isolate all HTTP traffic. Which filter expression should he use?

Accepted Answer

http. The correct filter is 'http' because in Wireshark, simply typing 'http' as a display filter captures all HTTP traffic, including both requests and responses. This is the most straightforward way to isolate all HTTP packets without limiting to a specific direction or port.

Answer

http.request

Answer

ip.proto == 6

Answer

tcp.port == 80

Question 15

In Linux forensics, which file contains information about user account passwords in hashed form?

Accepted Answer

/etc/shadow. In Linux, the /etc/shadow file stores user account passwords in hashed form, along with password aging information. This file is readable only by root (or privileged processes) to prevent unauthorized access to password hashes, unlike /etc/passwd which is world-readable and historically stored hashes but now typically shows an 'x' placeholder. The hashes are generated using algorithms like SHA-512 (crypt $6$) or yescrypt, as specified in the shadow file format.

Answer

/etc/passwd

Answer

/etc/group

Answer

/var/log/auth.log