CHFI OS and Network Forensics Practice Test 9 — 15 Questions

Question 1

During a network forensic investigation, the analyst examines firewall logs and notices a large number of outbound connections from an internal server to various IP addresses on port 443 at regular intervals. The connections are all initiated by a process called 'svchost.exe' running from a non-standard location (C:\Windows\Temp). What is the MOST likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The server is infected with malware that is beaconing to a command-and-control server. Svchost.exe running from C:\Windows\Temp is a classic sign of malware masquerading as a legitimate Windows process. The regular outbound connections on port 443 (HTTPS) at fixed intervals indicate beaconing behavior, where the infected host periodically contacts a command-and-control (C2) server to receive instructions or exfiltrate data. Legitimate svchost.exe resides in C:\Windows\System32, and any deviation from this path is a strong indicator of compromise.

Answer

The server is running a scheduled backup to an external cloud service

Answer

The server is performing legitimate Windows Update checks

Answer

The server is being used as a proxy for internal users

Question 2

Which Windows artifact is specifically designed to track the most recently used (MRU) files for specific applications and can be found in the NTUSER.DAT registry hive?

Accepted Answer

MRU lists in the registry. The NTUSER.DAT registry hive contains per-user MRU (Most Recently Used) lists that track files recently accessed by specific applications, such as the 'RecentDocs' key for Office applications or 'ComDlg32' for common dialog boxes. These registry keys are explicitly designed to store MRU data, making them the direct artifact for this purpose.

Answer

Prefetch files

Answer

Jump Lists

Answer

LNK files

Question 3

Which tool is commonly used in timeline analysis for digital forensics to parse various artifacts and create a super timeline?

Accepted Answer

log2timeline / Plaso. log2timeline (now part of the Plaso framework) is specifically designed to parse a wide variety of digital forensic artifacts—such as Windows Event Logs, Prefetch files, registry hives, and browser history—and aggregate them into a single, unified super timeline. This super timeline allows investigators to correlate events across different data sources and identify sequences of activity with precise timestamps, which is essential for timeline analysis in OS and network forensics.

Answer

Volatility

Answer

Wireshark

Answer

Sleuth Kit

Question 4

A forensic analyst is examining a Windows system for evidence of a program that runs automatically every time the system starts. Which registry key is commonly used to achieve persistence via the 'Run' key?

Accepted Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Run. The 'Run' key at HKLM\Software\Microsoft\Windows\CurrentVersion\Run is the standard registry location used by legitimate software and malware alike to execute a program automatically at every system startup. This key stores values that point to executable paths, and Windows’ Winlogon process reads these values during boot to launch the specified programs. It is a primary persistence mechanism in Windows forensics.

Answer

HKLM\SAM\SAM

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Question 5

A forensic analyst is examining browser history from a Chrome installation on a Windows system. Where is the Chrome history database typically stored?

Accepted Answer

%LOCALAPPDATA%\Google\Chrome\User Data\Default\History. Chrome stores its browsing history in a SQLite database file named 'History' located under the user's local app data directory. The full path is %LOCALAPPDATA%\Google\Chrome\User Data\Default\History. This file contains tables such as 'urls' and 'visits' that record all visited URLs, timestamps, and visit counts.

Answer

%APPDATA%\Mozilla\Firefox\Profiles\

Answer

%WINDIR%\System32\config\

Answer

%USERPROFILE%\Favorites\

Question 6

Which TWO Windows Event IDs are associated with successful and failed logon events? (Select two.)

Accepted Answer

4625. Event ID 4625 [CORRECT] is the Security log entry generated when a logon attempt fails, recording details such as the account name, logon type, and failure reason, so it directly answers the failed-logon half of the question. Event ID 4624 [CORRECT] is the Security log entry generated when a logon attempt succeeds, capturing the new logon's account, logon type, and authentication package, so it answers the successful-logon half. Together these two IDs are the canonical pair for tracking successful and failed interactive, network, and service logons. The other options do not belong: 4720 is logged when a user account is created, 7045 is a System log entry recording a new service being installed, and 4648 records a logon attempt using explicit credentials (such as RunAs), not a standard success or failure logon event.

Answer

4720

Answer

7045

Answer

4648

Question 7

Which TWO of the following are tools commonly used for network forensics analysis? (Select two.)

Accepted Answer

tcpdump. tcpdump (A) is a command-line packet capture and analysis tool that uses libpcap to intercept and decode live network traffic, making it a staple for network forensics. Wireshark (E) is the de facto GUI protocol analyzer that captures packets and provides deep dissection of hundreds of protocols, so it is also a core network forensics tool. By contrast, Autopsy (B) is a disk/image forensics platform for file system and artifact analysis, Volatility (C) is a memory forensics framework for RAM dumps, and dd (D) is a low-level imaging/duplication utility — none of these are primarily used to capture or analyze network traffic.

Answer

Autopsy

Answer

Volatility

Answer

dd

Question 8

A forensic analyst is examining a Windows 10 system and finds suspicious activity. Which registry hive contains user-specific configuration data that can reveal evidence of recent file access through ShellBags, UserAssist, and MRU lists?

Accepted Answer

NTUSER.DAT. The NTUSER.DAT file is the registry hive that stores user-specific configuration data for each user profile on a Windows 10 system. It contains the ShellBags keys (for folder view settings and recent folder access), UserAssist keys (tracking GUI-based program executions via the ROT13-encoded count and timestamp), and MRU (Most Recently Used) lists (for recently opened files and applications). These artifacts are critical for forensic analysis of user activity, and they are not stored in any of the HKLM hives, which are machine-wide.

Answer

HKLM\SYSTEM

Answer

HKLM\SAM

Answer

HKLM\SOFTWARE

Question 9

A security analyst is reviewing Windows Event Logs and notices multiple Event ID 4625 entries for a single user account within a short time frame. What does this most likely indicate?

Accepted Answer

A brute-force password guessing attack. Event ID 4625 is the Windows security log event for a failed logon attempt. A high frequency of these events for the same user account within a short time frame is a classic indicator of an automated brute-force password guessing attack, where an attacker tries multiple passwords against a single account.

Answer

Successful user logins

Answer

Account creation events

Answer

Service installation

Question 10

A forensic analyst is investigating a Windows system for evidence of USB device usage. Which registry key is MOST useful for determining the first time a USB device was connected and its serial number?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum stores a subkey for each USB mass storage device that has ever been connected to the system. Each subkey is named with the device's serial number, and its creation timestamp reflects the first time the device was enumerated (i.e., first connected). This makes it the definitive source for both the serial number and the initial connection time of a USB device.

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellBags

Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USB

Question 11

During a forensic investigation of a Linux system, you need to determine which commands a user executed in their shell session. Which file would you examine to find this information?

Accepted Answer

/home/username/.bash_history. The .bash_history file in a user's home directory stores the command history for that user's interactive Bash shell sessions. By default, Bash appends each command to this file when the session ends, making it the primary source for reconstructing a user's executed commands during forensic analysis.

Answer

/var/log/auth.log

Answer

/etc/passwd

Answer

/var/log/syslog

Question 12

Which Windows Event ID is generated when a new service is installed on a system, and is often used by malware to establish persistence?

Accepted Answer

7045. Event ID 7045 is generated by the Windows Service Control Manager (SCM) when a new service is installed on the system. Malware often uses this event to establish persistence by creating a service that automatically starts, and forensic analysts look for 7045 events to detect unauthorized service installations.

Answer

4624

Answer

4648

Answer

4720

Question 13

A network analyst captures traffic and sees an HTTP request containing: GET /wp-content/uploads/evil.php?cmd=id HTTP/1.1. Which of the following is MOST likely occurring?

Accepted Answer

Webshell access. The HTTP request `GET /wp-content/uploads/evil.php?cmd=id HTTP/1.1` indicates that the attacker is accessing a PHP file (`evil.php`) in the WordPress uploads directory and passing a command (`cmd=id`) to it. This is a classic indicator of a webshell — a malicious script uploaded to the server that allows remote command execution. The `id` command is a common Unix command used to verify the current user context, confirming the attacker has achieved interactive shell-like access.

Answer

SQL injection attack

Answer

Cross-site scripting (XSS) attack

Answer

Directory traversal attack

Question 14

A forensic analyst is using Plaso (log2timeline) to create a super timeline from a compromised Windows system. Which of the following is the PRIMARY advantage of using Plaso over manual timeline creation?

Accepted Answer

It automatically correlates events from different sources and provides a unified timeline. Plaso (log2timeline) is designed to automatically parse and correlate artifacts from multiple sources—such as Windows Event Logs, Registry hives, Prefetch files, and USN journals—into a single, unified super timeline. This eliminates the need for manual correlation across disparate log files, which is error-prone and time-consuming, making automated correlation the primary advantage over manual timeline creation.

Answer

It can detect malware by signature scanning

Answer

It generates a timeline only from Windows Event Logs

Answer

It encrypts the timeline for secure storage

Question 15

Which tool is specifically designed for timeline analysis in digital forensics and is the command-line version of the log2timeline framework?

Accepted Answer

Plaso. Plaso (Python Log2Timeline) is the command-line version of the log2timeline framework, specifically engineered for super timeline creation and timeline analysis in digital forensics. It parses multiple log and artifact sources (e.g., Windows Event Logs, Prefetch, Registry hives) into a unified, high-performance timeline database (SQLite or Elasticsearch), enabling examiners to correlate events across time. This makes it the direct answer to a question asking for the CLI tool derived from the log2timeline framework.

Answer

Autopsy

Answer

Sleuth Kit

Answer

Wireshark