CHFI OS and Network Forensics — Timed 20 Questions

Question 1

A security analyst investigates a Windows system and finds an event with ID 4625 in the Security log. What does this event indicate?

Accepted Answer

A failed logon attempt. Event ID 4625 indicates a failed logon attempt. This is a standard Windows security event used to track authentication failures.

Answer

A successful user logon

Answer

A service was installed

Answer

A new user account was created

Question 2

During a forensic analysis of a compromised Linux server, you notice that the file /var/log/auth.log has been cleared. However, you find that the attacker's commands are still partially recoverable. Which artifact most likely contains the attacker's command history?

Accepted Answer

~/.bash_history. The bash_history file for each user (typically ~/.bash_history) stores command-line history. Even if auth.log is cleared, this file often retains command entries.

Answer

/var/log/syslog

Answer

/proc/1/cmdline

Answer

/etc/shadow

Question 3

A forensic analyst recovers a USB device from a suspect's computer. Which Windows registry key should be examined to determine the first time the USB device was connected?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key records serial numbers and first/last connection times for USB storage devices.

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Question 4

An analyst suspects that an attacker used a web shell to execute commands on a Windows web server. Which Windows event ID should the analyst look for to detect service installation that may have been used for persistence?

Accepted Answer

7045. Event ID 7045 indicates a service was installed on the system, which attackers often use to maintain persistence.

Answer

4624

Answer

4648

Answer

4720

Question 5

A forensic examiner is analyzing a Mac system and wants to review system logs that record various activities, including application launches and kernel events. Which logging system on macOS should be examined?

Accepted Answer

Unified logging (log command). Unified logging (via log command) captures system and user activity in a centralized database, replacing traditional syslog.

Answer

.plist files

Answer

FSEvents

Answer

Console.app logs

Question 6

In Windows forensics, which artifact is used to track recently accessed files and folders via the 'Recent Items' feature?

Accepted Answer

LNK files. LNK files (shortcuts) are created automatically when a user opens a file, and they contain metadata such as the target path and timestamps.

Answer

Jump lists

Answer

ShellBags

Answer

Prefetch files

Question 7

A network analyst is reviewing a packet capture and sees a large number of TCP SYN packets sent to various ports on a single host from multiple source IPs. This pattern is most indicative of which type of attack?

Accepted Answer

SYN flood. A SYN flood sends many SYN packets without completing the handshake, overwhelming the target. The source IPs may be spoofed.

Answer

ARP spoofing

Answer

DNS amplification

Answer

Ping of death

Question 8

During a Linux forensic investigation, you find that the file /etc/cron.d/evil contains the entry: '* * * * * root /bin/bash /root/backdoor.sh'. What persistence mechanism is being used?

Accepted Answer

Cron job. Cron jobs in /etc/cron.d are system-wide scheduled tasks. This entry runs a script every minute as root, providing persistence.

Answer

Systemd service

Answer

Init script

Answer

At job

Question 9

Which of the following Windows registry keys is commonly used by malware to achieve persistence by executing a program at user logon?

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. The Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a common persistence location; it runs the specified program when the user logs in.

Answer

HKEY_LOCAL_MACHINE\SAM\SAM

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Question 10

In network forensics, which tool is commonly used to analyze and visualize NetFlow data to identify network traffic patterns?

Accepted Answer

SolarWinds NetFlow Traffic Analyzer. Wireshark is a packet analyzer, not a NetFlow analyzer. Nmap scans networks. Splunk can analyze logs but is not specifically a NetFlow tool. SolarWinds NetFlow Traffic Analyzer is designed for NetFlow analysis.

Answer

Wireshark

Answer

Splunk

Answer

Nmap

Question 11

A forensic analyst is examining a Windows system and finds that the UserAssist key in the NTUSER.DAT hive contains entries with Rot13-encoded names. What is the primary purpose of the UserAssist key?

Accepted Answer

Log program execution counts and last run times. UserAssist tracks application execution count and last run time. The Rot13 obfuscation is to hide the names from casual viewing.

Answer

Record USB device connection history

Answer

Store user password history

Answer

Track recently opened documents via Jump Lists

Question 12

An attacker has compromised a Linux server and edited the /etc/passwd file to change a user's UID to 0. What is the likely goal of this modification?

Accepted Answer

To escalate privileges to root. UID 0 is the root user. Changing a user's UID to 0 grants that user root privileges, providing privileged access.

Answer

To lock the user account

Answer

To enable password-less login

Answer

To hide the user account from the system

Question 13

A forensic analyst is examining a Windows system and wants to identify recently accessed files and programs. Which TWO artifacts should the analyst prioritize? (Select TWO.)

Accepted Answer

Jump Lists. Prefetch files track application launches; Jump Lists track recently used files per application.

Answer

Event ID 4624 logs

Answer

System Restore points

Answer

SAM registry hive

Question 14

A security team is analyzing a compromised Linux server. Indicators suggest the attacker used a web shell. Which THREE of the following are common persistence mechanisms that may be found on the system? (Select THREE.)

Accepted Answer

Adding an SSH public key to /root/.ssh/authorized_keys. Cron jobs, SSH authorized keys, and systemd services are common persistence mechanisms on Linux.

Answer

Modification of the NTUSER.DAT registry hive

Answer

Prefetch file creation

Question 15

An investigator is analyzing a Windows system and wants to find evidence of USB device usage. Which TWO registry keys should be examined? (Select TWO.)

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. USBSTOR stores connected USB devices; MountPoints2 stores volume mount points with device identifiers.

Answer

HKLM\SAM\SAM

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Question 16

A security analyst reviews Windows Security Event Logs and finds multiple Event ID 4625 entries from a single source IP address targeting various usernames. Which type of attack is MOST likely occurring?

Accepted Answer

Password spraying attack. Event ID 4625 indicates a failed logon attempt. Multiple failed attempts from one source against different usernames is characteristic of a password spraying attack, where an attacker tries a few common passwords across many accounts.

Answer

Brute-force attack on a single account

Answer

Pass-the-hash attack

Answer

Kerberoasting attack

Question 17

During a forensic investigation of a compromised Linux server, you find the following entry in /var/log/auth.log: 'Mar 10 03:14:15 server sshd[1234]: Accepted publickey for root from 10.0.0.5 port 54321 ssh2: RSA SHA256:AbCdEf123456'. Which artifact should you examine next to determine if unauthorized key-based access occurred?

Accepted Answer

~/.ssh/authorized_keys. The log shows acceptance of a public key. To determine if the key was unauthorized, you must examine the authorized_keys file for root (~/.ssh/authorized_keys) to see if the key was added maliciously.

Answer

/var/log/syslog

Answer

/etc/ssh/sshd_config

Answer

/etc/passwd

Question 18

Which Windows artifact is primarily used to determine the execution history of applications, including the path and run count?

Accepted Answer

Prefetch files. Prefetch files (.pf) store information about recently executed applications, including execution count and timestamps. They are located in C:\Windows\Prefetch.

Answer

LNK files

Answer

Jump lists

Answer

Event logs

Question 19

A forensic analyst discovers an unusual entry in the Windows Registry under 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run'. Which persistence mechanism does this represent?

Accepted Answer

Registry Run key persistence. The Run key is a standard location for programs to auto-start when a user logs on. A malicious entry here indicates persistence via registry run keys.

Answer

Service installation

Answer

Scheduled task

Answer

Startup folder

Question 20

In a macOS forensic investigation, which log system provides a timeline of high-level system events such as application launches and user logins?

Accepted Answer

FSEvents. FSEvents is a macOS logging system that records changes to the file system, including application launches and user logins, providing a timeline of system activity.

Answer

syslog

Answer

.plist files

Answer

Unified logging