CHFI OS and Network Forensics Practice Test 9 — 15 Questions

Question 1

A security analyst reviews Windows Security Event Log and observes Event ID 4625 repeatedly for a single user account from a remote IP address within a short timeframe. What is the MOST likely cause?

Accepted Answer

A brute-force password attack is occurring against that account. Event ID 4625 indicates a failed logon attempt. Repeated failures from a remote IP suggest a brute-force password guessing attack.

Answer

The user successfully logged on from a remote workstation

Answer

The user's account was created

Answer

A service was installed on the system

Question 2

During a forensic investigation of a compromised Linux server, an analyst checks /var/log/auth.log and finds multiple entries like "Failed password for root from 10.0.0.5 port 22 ssh2". Which tool is BEST suited to analyze the timeline of these events?

Accepted Answer

log2timeline. log2timeline (part of Plaso) is designed for timeline analysis of log files, including auth.log. It parses and correlates timestamps.

Answer

Nmap

Answer

Wireshark

Answer

Autopsy

Question 3

A forensic analyst finds a suspicious .plist file in /Library/LaunchDaemons/ on a macOS system. The file contains a key "ProgramArguments" with a path to a script in /tmp. Which persistence mechanism does this indicate?

Accepted Answer

Launch daemon. LaunchDaemons are used for system-wide daemons that start at boot. A plist in /Library/LaunchDaemons/ with ProgramArguments indicates a launch daemon persistence mechanism.

Answer

Cron job

Answer

Login item

Answer

Kernel extension

Question 4

A network forensics analyst captures traffic from a suspected data exfiltration. In Wireshark, filtering for DNS queries containing a long subdomain with base64-encoded text suggests which technique?

Accepted Answer

DNS tunneling. DNS tunneling encodes data in DNS queries to exfiltrate information, often using base64 in subdomains.

Answer

DNS hijacking

Answer

DNS poisoning

Answer

DNS amplification

Question 5

Which Windows Registry hive contains user-specific configuration such as MRU lists and UserAssist artifacts?

Accepted Answer

NTUSER.DAT. NTUSER.DAT is the registry hive for user-specific settings, located in %UserProfile%. It contains MRU lists, UserAssist, and other user activity artifacts.

Answer

HKLM\SAM

Answer

SYSTEM

Answer

HKLM\System

Question 6

A Linux system is suspected of being used as a pivot point. An analyst checks /proc/[pid]/fd/ and sees open file descriptors pointing to sockets. Which command would BEST determine the remote connections associated with these sockets?

Accepted Answer

lsof -i. lsof -i shows network connections and listening sockets, including remote addresses. It can read /proc fd info.

Answer

netstat -anp

Answer

cat /proc/net/tcp

Answer

ls -la /proc/[pid]/fd/

Question 7

A forensic examiner recovers a Windows 10 system and finds a prefetch file for powershell.exe with a last run time of 3 days ago, but the system's security logs show no interactive logons from that user. What does this discrepancy suggest?

Accepted Answer

PowerShell was executed as part of a scheduled task or service. Prefetch files record execution times. If PowerShell ran but no interactive logon, it likely ran via a scheduled task or service, which doesn't create an interactive logon event (Event ID 4624 with logon type 2).

Answer

The prefetch file is corrupted

Answer

The user deleted their profile

Answer

The system clock was changed

Question 8

An analyst identifies an unknown binary running on a Linux server. Which /proc filesystem entry would provide the command-line arguments used to start the process?

Accepted Answer

/proc/[pid]/cmdline. /proc/[pid]/cmdline contains the command-line arguments of the process, null-separated.

Answer

/proc/[pid]/maps

Answer

/proc/[pid]/status

Answer

/proc/[pid]/environ

Question 9

In a macOS forensic investigation, which log system stores high-level events such as application launches and authentication attempts in a binary format, and can be queried using the 'log' command?

Accepted Answer

Unified logging. Unified logging (os_log) is the modern macOS logging system, storing events in a binary format and queried via the 'log' command.

Answer

system.log

Answer

Audit log

Answer

FSEvents

Question 10

A security team detects exfiltration via HTTP POST requests to a suspicious domain. Which network forensic technique would BEST identify the data being sent in these requests?

Accepted Answer

Wireshark packet capture with HTTP follow stream. Wireshark can capture and display the full packet contents, including HTTP POST body data, allowing analysis of exfiltrated data.

Answer

Firewall log review

Answer

IDS alert correlation

Answer

NetFlow analysis

Question 11

During a forensic examination of a compromised Windows server, you find a registry key under HKLM\SYSTEM\CurrentControlSet\Services that points to a malicious DLL. Which event ID would have been generated when this service was installed?

Accepted Answer

7045. Event ID 7045 is logged when a new service is installed on Windows.

Answer

4648

Answer

4720

Answer

4624

Question 12

A Linux investigator wants to see all commands run by a user from the bash shell. Which file should be examined?

Accepted Answer

~/.bash_history. The .bash_history file in the user's home directory contains the command history for bash.

Answer

/etc/passwd

Answer

/var/log/auth.log

Answer

/var/log/syslog

Question 13

A forensic analyst is examining a Windows system for evidence of USB device usage. Which TWO registry locations are known to store USB device history?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. USB device history is stored in USBSTOR and MountPoints2 keys.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Prefetch

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKLM\SAM\SAM\Domains\Account\Users

Question 14

A security analyst is investigating a potential webshell on an IIS server. Which THREE artifacts are commonly associated with webshell presence?

Accepted Answer

Presence of encoded scripts in the web application directory. Webshells leave traces in IIS logs (HTTP requests), file system (malicious files in web directories), and event logs (process creation or errors).

Answer

Increase in NetFlow traffic to a known good update server

Answer

Event ID 4624 logon events from the service account

Question 15

An analyst is reviewing firewall logs and sees repeated outbound connections from an internal host to a known malicious IP on port 443. Which TWO network forensic data sources would BEST help determine if data exfiltration occurred?

Accepted Answer

Full packet capture (PCAP) of the sessions. Full packet capture provides payload content, and TLS interception logs show decrypted traffic if available.

Answer

NetFlow records showing packet sizes and counts

Answer

IDS alerts for signatures

Answer

Windows security event logs