CHFI OS and Network Forensics Practice Test 9 — 15 Questions

Question 1

An analyst captures network traffic during an incident and wants to extract files transferred over HTTP. Which Wireshark feature is BEST suited for this task?

Accepted Answer

Export Objects > HTTP. Wireshark's 'Export Objects > HTTP' feature is specifically designed to extract files (e.g., images, documents, executables) transferred over HTTP by reassembling the TCP streams and parsing the HTTP response bodies. This feature automates the extraction process, saving the analyst from manually reconstructing each file from raw packets.

Answer

Follow TCP Stream

Answer

Statistics > HTTP

Answer

Analyze > Expert Info

Question 2

During a forensic examination of a macOS system, an investigator wants to review application execution history. Which artifact contains a chronological record of application launches, including timestamps and process IDs?

Accepted Answer

Unified logging (log command). macOS unified logging provides detailed system activity including application launches. FSEvents records file system changes but not process launches. .plist files may store settings, not execution history.

Answer

FSEvents

Answer

com.apple.launchd.plist

Answer

syslog

Question 3

A security team detects a suspicious process that writes to the Windows registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run. What is the MOST likely purpose of this activity?

Accepted Answer

Establishing persistence for malware. The Run key is a common auto-start location used for persistence. Writing to it ensures the process executes at user logon.

Answer

Clearing browser history

Answer

Updating system time

Answer

Configuring firewall rules

Question 4

A forensic analyst is examining a Windows system and finds a prefetch file named NOTEPAD.EXE-12345678.pf. What information can be gleaned from this artifact? (Select the BEST answer.)

Accepted Answer

It records the application's execution count and last run time. Prefetch files in Windows are designed to speed up application startup by caching information about the files loaded during the first few seconds of execution. The filename includes the application name and a hash of the file path, while the internal metadata records the execution count and last run time, making option C correct.

Answer

It saves a copy of the application's configuration

Answer

It logs all network connections made by the application

Answer

The file contains the user's password for the application

Question 5

During a network breach investigation, an analyst examines NetFlow records and sees large data transfers from a server to an external IP address during off-hours. Which type of activity does this MOST likely indicate?

Accepted Answer

Data exfiltration by an attacker. Large data transfers from a server to an external IP address during off-hours are a classic indicator of data exfiltration. NetFlow records capture metadata such as source/destination IPs, ports, and byte counts; a sudden, high-volume outbound flow to an unfamiliar external IP outside normal business hours strongly suggests an attacker is copying sensitive data out of the network, not legitimate traffic.

Answer

Normal software update download

Answer

Scheduled backup to a cloud service

Answer

Denial-of-service attack against the server

Question 6

A forensic analyst needs to create a timeline of file system activity from a disk image. Which tool is specifically designed for this purpose and can parse various artifacts such as registry, prefetch, and log files?

Accepted Answer

Plaso (log2timeline). Plaso (log2timeline) is the correct tool because it is specifically designed to create super timelines of file system activity from disk images. It parses a wide range of artifacts including the Windows Registry, Prefetch files, event logs, and other log files, correlating timestamps to reconstruct a chronological sequence of system events.

Answer

Wireshark

Answer

Volatility

Answer

FTK Imager

Question 7

An incident responder examines a Linux server and finds a suspicious cron job that runs every minute and executes a script located in /tmp. Which persistence technique does this represent?

Accepted Answer

Cron-based persistence. Cron is a Linux job scheduler that executes tasks at specified intervals. A cron job running every minute from /tmp indicates an attacker has added a persistent scheduled task to maintain access, which is a classic example of cron-based persistence. This technique leverages the cron daemon (crond) to re-execute malicious code automatically, ensuring the attacker's foothold survives reboots.

Answer

Kernel rootkit

Answer

Web shell

Answer

SSH key backdoor

Question 8

Which TWO Windows registry hives are most commonly analyzed during a forensic investigation to determine user activity and system configuration? (Select TWO.)

Accepted Answer

HKLM\SAM. The HKLM\SAM hive stores hashed user passwords and account information, making it critical for credential analysis and user enumeration. The HKCU\...\NTUSER.DAT hive contains per-user configuration, application usage, and activity traces, directly reflecting user behavior. Both are routinely extracted in forensic acquisitions to reconstruct user actions and system state.

Answer

HKU\.DEFAULT

Answer

HKLM\COMPONENTS

Answer

HKLM\BCD

Question 9

Which THREE of the following are common indicators of a web shell presence on a compromised IIS web server? (Select THREE.)

Accepted Answer

Process w3wp.exe making outbound connections to an unknown IP. W3wp.exe is the IIS worker process for ASP.NET applications. A compromised web shell often causes this process to initiate outbound connections to a command-and-control (C2) server or to exfiltrate data, which is anomalous since legitimate IIS worker processes typically do not make outbound connections to unknown external IP addresses.

Answer

Increased 404 errors in HTTP logs

Answer

Normal GET requests to static .html pages

Question 10

Which TWO of the following are primary locations for browser history artifacts in a Windows 10 system? (Select TWO.)

Accepted Answer

%USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\History. Chrome stores history in History (SQLite). Microsoft Edge/IE store history in WebCacheV01.dat (ESE database). Firefox stores history in places.sqlite. All three are primary browser history artifacts on Windows 10. The original explanation only covers Chrome and omits justification for WebCacheV01.dat and why Firefox's places.sqlite is wrong.

Answer

%USERPROFILE%\AppData\Local\Microsoft\Windows\Temporary Internet Files

Answer

%USERPROFILE%\AppData\Local\Temp

Question 11

A security analyst reviews Windows Security Event Log and finds multiple Event ID 4625 entries for a single user account within a few seconds. What does this pattern MOST likely indicate?

Accepted Answer

Brute-force password attack. Event ID 4625 is a Windows Security log event that records failed logon attempts. When multiple 4625 events appear for the same user account within a few seconds, it indicates a high volume of authentication failures in a short time window, which is the classic signature of a brute-force password attack. The rapid succession of failures rules out accidental mistypes and points to an automated or manual attempt to guess the password.

Answer

Service installation

Answer

Account creation

Answer

Successful logon by the user

Question 12

During a forensic investigation of a Windows system, an analyst examines the NTUSER.DAT registry hive. Which artifact would MOST likely be found to identify recently accessed documents and folders via the Windows Explorer GUI?

Accepted Answer

ShellBags. ShellBags are stored in the NTUSER.DAT hive under the BagMRU and Bags keys, and they track the view settings and paths of folders and documents accessed via Windows Explorer. This makes them the definitive artifact for identifying recently accessed folders and documents through the GUI, as they persist even after the files themselves are deleted or moved.

Answer

Run keys

Answer

MRU lists

Answer

UserAssist

Question 13

A Linux system administrator notices that the /var/log/auth.log file shows many 'Failed password for root' entries from a single IP address within a short timeframe. Which tool would BEST help the administrator block further access from that IP?

Accepted Answer

iptables. B (iptables) is correct because it is a Linux firewall utility that can create rules to drop or reject incoming packets from a specific IP address. By adding a rule such as `iptables -A INPUT -s <IP> -j DROP`, the administrator can immediately block all further traffic from that IP, preventing additional brute-force attempts.

Answer

nmap

Answer

tcpdump

Answer

Wireshark

Question 14

During a Mac forensic examination, an investigator needs to find evidence of recently executed applications and accessed files. Which artifact should the investigator prioritize for reconstructing user activity?

Accepted Answer

Unified logging. Unified logging (C) is the correct artifact because it centrally records process execution events (application launches) and system/file activity, making it the most suitable for reconstructing user activity. FSEvents only captures file system changes (creation, modification, deletion, renaming) and does not log process execution or file reads. bash_history only covers shell commands, and plist preferences contain app settings rather than a direct record of execution/access.

Answer

bash_history

Answer

FSEvents

Answer

.plist files in ~/Library/Preferences

Question 15

A network analyst captures suspicious traffic and uses Wireshark to examine packets. The analyst notices many TCP SYN packets sent to various ports on a single host with no SYN-ACK replies. What type of activity is MOST likely observed?

Accepted Answer

Port scan. The observation of multiple TCP SYN packets sent to various ports on a single host without any SYN-ACK replies is the classic signature of a TCP SYN port scan. In a port scan, the attacker sends SYN packets to probe which ports are open; if a port is closed, the host responds with a RST packet, but if no SYN-ACK is returned, it typically indicates the port is filtered (blocked by a firewall) or the host is not responding. This behavior is distinct from a DoS attack, which would flood a single port with traffic to overwhelm the target.

Answer

Denial of Service (DoS) attack

Answer

DNS amplification

Answer

ARP poisoning