CHFI Hard Questions — 25 Difficult Questions

Question 1

During a forensic investigation, an analyst needs to acquire the contents of a live server's RAM without altering the evidence. Which tool and technique should the analyst use to minimize the footprint on the system?

Accepted Answer

Run a trusted version of win32dd.exe from a write-protected USB drive and capture memory to the USB. Option B is correct because running a trusted version of win32dd.exe (now commonly part of the Belkasoft or DumpIt suite) from a write-protected USB drive ensures the tool binary is not modified by the compromised system and does not write any artifacts to the server's disk. Capturing memory directly to the USB drive minimizes the forensic footprint by avoiding writes to the server's local storage, preserving the integrity of the evidence.

Answer

Install FTK Imager on the server and capture memory to a network share

Answer

Use a remote acquisition tool over SSH to capture memory to a remote server

Answer

Use the built-in task manager to create a memory dump and save it locally

Question 2

You are a forensic investigator responding to a data breach at a mid-sized company. The company uses a hybrid cloud environment with AWS for production workloads and on-premises servers for legacy applications. The breach was detected when an internal monitoring system flagged unusual outbound traffic from an AWS EC2 instance (i-0a1b2c3d4e5f) to an external IP address (198.51.100.20) on TCP port 4444 during off-hours. The EC2 instance runs a Linux-based web server. The security team has already isolated the instance by removing its security group rules and stopping the instance. You have been provided with the following: (1) AWS CloudTrail logs for the past 72 hours, (2) VPC Flow Logs for the same period, (3) a snapshot of the instance’s root volume (EBS), and (4) the instance metadata log from the AWS console. The company’s incident response policy requires preservation of all volatile data before powering off the instance. Which of the following steps should you take FIRST to ensure a forensically sound investigation?

Accepted Answer

Create a forensic copy of the EBS snapshot and attach it to a separate analysis EC2 instance in a different AWS account to avoid altering evidence.. Option C is correct because the first step in a forensically sound investigation is to create a forensic copy (bit-for-bit) of the EBS snapshot before any analysis. This preserves the original evidence integrity, as required by the order of volatility and chain of custody. Attaching the copy to a separate analysis EC2 instance in a different AWS account prevents accidental modification of the original snapshot and isolates the forensic environment from the compromised production account.

Answer

Acquire a memory dump from the stopped instance by re-attaching the root volume to a forensic workstation.

Answer

Review the instance metadata log to identify the user who launched the instance.

Answer

Analyze the VPC Flow Logs to determine if other instances communicated with the same external IP.

Question 3

Which TWO of the following are valid techniques for collecting volatile network evidence from a live system during incident response?

Accepted Answer

Running netstat -an to view active TCP/UDP connections.. Option D is correct because `netstat -an` displays all active TCP and UDP connections along with their listening ports and states, which is critical for identifying unauthorized or malicious network connections on a live system. This command provides a snapshot of current network sessions without altering system state, making it a standard volatile evidence collection technique.

Answer

Using route print to view the IP routing table.

Answer

Using ipconfig /displaydns to view the DNS resolver cache.

Answer

Running arp -a to view the ARP table.

Question 4

Refer to the exhibit. The FTK Imager output shows a disk with an NTFS partition. The examiner notes that the $MFT mirror is at cluster 2. What is the logical size of the $MFT mirror in bytes?

Accepted Answer

4096 bytes. The $MFT mirror is a backup copy of the first four records of the Master File Table. Each MFT record is 1024 bytes, so four records total 4096 bytes. The FTK Imager output confirms the cluster size is 4096 bytes, and since the $MFT mirror occupies exactly one cluster (cluster 2), its logical size is 4096 bytes.

Answer

320 GB

Answer

512 bytes

Answer

8192 bytes

Question 5

Which THREE of the following are indicators of malware persistence via registry run keys? (Choose three.)

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce is a registry run key that executes programs once at user logon and then deletes the entry. Malware often uses this key to run a payload a single time, such as during initial infection or after a reboot, to establish persistence without leaving a continuous trace in the Run key.

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Question 6

Which THREE of the following are essential steps in the incident response process as defined by NIST SP 800-61? (Select exactly 3.)

Accepted Answer

Post-Incident Activity. Option B is correct because Post-Incident Activity is one of the four core phases in the NIST SP 800-61 incident response lifecycle. This phase includes lessons learned, evidence retention, and report generation to improve future response efforts. Without this step, the organization cannot close the loop on security incidents or refine their detection and response capabilities.

Answer

Vulnerability Assessment

Answer

Penetration Testing

Question 7

During an incident response, a first responder needs to preserve the integrity of evidence. Which action ensures the best chain of custody?

Accepted Answer

Compute a SHA-256 hash of the acquired image immediately after collection and record it in the chain of custody form.. Option B is correct because computing a SHA-256 hash immediately after acquisition creates a cryptographic fingerprint of the image. This hash, when recorded in the chain of custody form, provides verifiable integrity: any subsequent alteration of the image will produce a different hash, proving tampering. While other steps are important, only hashing directly ties the evidence's integrity to a mathematical proof that can be independently verified later.

Answer

Use a write blocker when acquiring the disk image.

Answer

Document every person who handled the evidence.

Answer

Place the evidence in an evidence bag and lock it in a secure room.

Question 8

During an incident response, a first responder needs to collect evidence from a Linux server that is still running. The server has sensitive data and cannot be shut down. Which technique is BEST for acquiring a forensic image of the hard disk?

Accepted Answer

Use dd if=/dev/sda of=/mnt/evidence/image.dd bs=4M. Option B is correct because it uses dd with a 4M block size, which improves acquisition speed while still producing a bit-for-bit forensic image of the entire disk (/dev/sda). The conv=noerror,sync option in A is unnecessary for a live acquisition from a healthy disk and can mask read errors, while B's larger block size is more efficient for imaging a running system without shutdown.

Answer

Use dd if=/dev/sda of=/mnt/evidence/image.dd conv=noerror,sync

Answer

Use dd if=/dev/mapper/root of=/mnt/evidence/image.dd

Answer

Use dd if=/dev/sda1 of=/mnt/evidence/image.dd

Question 9

A forensic lab is designing a network architecture to ensure the integrity of evidence during acquisition. What is the most critical design consideration?

Accepted Answer

Implement hardware write-blockers on all acquisition stations. Hardware write-blockers are the most critical design consideration because they physically prevent any write operations to the source drive at the ATA/SCSI command level, ensuring that the evidence remains bit-for-bit unchanged during acquisition. Without a hardware write-blocker, even a single read operation from a forensic workstation could inadvertently modify metadata (e.g., last access timestamps) or trigger anti-forensic mechanisms, compromising the integrity of the evidence and its admissibility in court.

Answer

Deploy multiple forensic workstations to parallelize tasks

Answer

Use a segmented network to isolate forensic tools

Answer

Encrypt all data in transit over the network

Question 10

An organization uses a cloud-based SIEM to collect logs from multiple sources. The investigator notices gaps in the log data for a critical system during the incident timeframe. What is the MOST likely cause?

Accepted Answer

Time drift between the system and the SIEM. Time drift between the system and the SIEM causes logs to be timestamped incorrectly, leading to apparent gaps when the SIEM queries by time range. Even if logs are delivered, they may fall outside the incident timeframe in the SIEM's index, creating the illusion of missing data. This is a common issue in cloud-based SIEMs where NTP synchronization is not enforced across all sources.

Answer

Network latency delayed log delivery

Answer

Log rotation policy deleted logs prematurely

Answer

The system's log level was set to ERROR only

Question 11

A forensic analyst is investigating a network breach and finds that the attacker used a technique that bypasses Network Access Control (NAC). Which of the following methods is commonly used to evade 802.1X authentication?

Accepted Answer

MAC address spoofing. MAC address spoofing is commonly used to bypass 802.1X authentication because 802.1X typically authenticates devices based on their MAC address after the EAP (Extensible Authentication Protocol) handshake. By spoofing the MAC address of an already-authenticated device, the attacker can impersonate that device and gain network access without valid credentials, effectively bypassing the NAC enforcement.

Answer

VLAN hopping using double tagging

Answer

DNS tunneling to exfiltrate data

Answer

ARP poisoning to redirect traffic

Question 12

An investigator finds the above IAM policy attached to an S3 bucket. What is the security concern?

Accepted Answer

The bucket is publicly accessible to read objects. Option C is correct because the IAM policy's `Principal` is set to `"*"` (wildcard), which means any unauthenticated user or anonymous entity on the internet can perform the `s3:GetObject` action. This makes the S3 bucket publicly readable, exposing all objects stored in the bucket to anyone who knows the bucket name and object key. The `Effect` is `Allow` and there is no condition restricting access, so the policy grants open read access to the entire bucket.

Answer

The resource does not include all objects

Answer

The policy version is outdated

Answer

The policy allows anyone to write objects to the bucket

Question 13

You are acquiring a laptop with a self-encrypting drive (SED) that is powered on and logged in. What is the best method to acquire the drive while preserving encrypted data?

Accepted Answer

Acquire a logical image from the running operating system. When a self-encrypting drive (SED) is powered on and logged in, the drive's hardware encryption key is already loaded and the data is accessible through the operating system. The best method to preserve the encrypted data in its decrypted state is to acquire a logical image from the running OS, which captures files and metadata without powering off the drive and losing the decryption context. Removing power or rebooting would cause the SED to lock, requiring the authentication key again and potentially altering the data state.

Answer

Remove the drive and use a forensic bridge that supports SED

Answer

Power off the laptop and image the drive using a hardware write blocker

Answer

Boot from a forensic live CD and image the drive

Question 14

Which TWO of the following are effective methods for detecting a man-in-the-middle attack on a network?

Accepted Answer

Check for SSL certificate mismatches. SSL certificate mismatches occur when a man-in-the-middle (MITM) attacker presents a forged or self-signed certificate that does not match the legitimate server's certificate. Browsers and security tools will flag this mismatch (e.g., different Common Name, invalid issuer, or expired validity), providing a clear indicator of an ongoing MITM attack. This is a direct detection method because the attacker cannot easily obtain a valid certificate for the target domain without the private key.

Answer

Analyze DNS amplification traffic

Answer

Implement port knocking for access control

Answer

Detect ICMP flood attacks

Question 15

An organization uses Microsoft SQL Server 2019 with full recovery model. A database administrator accidentally executed a DROP TABLE statement. The transaction log was backed up immediately after the incident. Which forensic technique would allow the analyst to restore the dropped table?

Accepted Answer

Perform a tail-log backup, then restore the full backup and all subsequent transaction log backups, stopping before the DROP TABLE.. Option C is correct because, under the full recovery model, point-in-time recovery is required to undo the DROP TABLE. By performing a tail-log backup (to capture any transactions after the last log backup), then restoring the full backup and all subsequent transaction log backups with STOPAT or STOPBEFOREMARK to the moment just before the DROP TABLE, the analyst can recover the table without losing other transactions. This is the only method that preserves the dropped table's data while maintaining database consistency.

Answer

Restore the transaction log backup taken after the DROP TABLE and apply it to the database.

Answer

Use the RESTORE LOG statement with the NO_TRUNCATE option to recover the table.

Answer

Restore the most recent full backup and ignore subsequent transaction log backups.

Question 16

You are a forensic investigator responding to an incident at a financial institution. The organization uses Microsoft SQL Server 2016 for its transaction processing system. The database is configured with full recovery model and transaction log backups are taken every 15 minutes. The incident response team has identified that an attacker gained access to the database server via compromised credentials and executed a series of malicious SQL statements, including data exfiltration and deletion of critical records. The time of the attack is estimated to be between 2:00 PM and 2:05 PM. The last full backup was taken at 12:00 AM (midnight) the same day. Transaction log backups are available for the entire day. The last transaction log backup before the attack was taken at 1:45 PM. The next transaction log backup after the attack was taken at 2:15 PM. The database is still online and being used by the business. Management wants to recover the database to a point just before the attack (2:00 PM) to minimize data loss, while preserving evidence for investigation. Which of the following actions should you take FIRST?

Accepted Answer

Perform a tail-log backup of the database using the NORECOVERY option to capture all transactions since the last log backup.. Performing a tail-log backup with NORECOVERY captures all transactions committed after the last log backup (1:45 PM) up to the current point in time, including the attack period. This preserves the database in a restoring state, preventing further changes while allowing point-in-time recovery to just before 2:00 PM. It is the mandatory first step to minimize data loss and maintain forensic integrity before any restore operations.

Answer

Immediately restore the full backup from midnight and all transaction log backups up to 1:45 PM to a separate server for forensic analysis.

Answer

Shut down the SQL Server service to prevent further changes and then restore the database from backup.

Answer

Restore the database to a point in time using the full backup and all transaction log backups up to 1:45 PM, then apply the 2:15 PM backup to recover lost data.

Question 17

A forensic analyst is examining a PostgreSQL database server that was compromised. The attacker gained superuser access and deleted several rows from a critical table. The database is configured with WAL (Write-Ahead Log) archiving. Which method would allow the analyst to identify the exact time the deletions occurred?

Accepted Answer

Use the pg_waldump utility to parse the WAL files and identify DELETE operations with timestamps.. D is correct because `pg_waldump` is the PostgreSQL utility specifically designed to parse Write-Ahead Log (WAL) files and display their contents in a human-readable format, including the exact timestamps and operation types (e.g., DELETE). Since the database uses WAL archiving, the archived WAL segments will contain a record of every data modification, allowing the analyst to pinpoint when the deletions occurred.

Answer

Review the pg_stat_activity view to see the history of queries executed.

Answer

Examine the archive_status directory to find the timestamp of the WAL file that contains the deletion.

Answer

Query the pg_audit table to retrieve a log of all DELETE statements.

Question 18

An organization suspects a stealthy malware infection on a critical server. Traditional antivirus and EDR solutions have not detected anything. Which forensic approach would be most effective in identifying the malware, given that it likely resides only in memory?

Accepted Answer

Acquire a memory dump and perform memory forensics with tools like Volatility. Option B is correct because the malware resides only in memory, making it invisible to disk-based scans. Memory forensics with tools like Volatility allows investigators to analyze RAM artifacts (e.g., processes, network connections, injected code) to detect stealthy malware that never writes to disk.

Answer

Perform a full disk scan with updated antivirus signatures

Answer

Conduct a live analysis using built-in Windows tools like Task Manager

Answer

Analyze network traffic for anomalies using a NetFlow analyzer

Question 19

Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?

Accepted Answer

It is a virtual directory that contains files with no parent directory, often from deleted files. In The Sleuth Kit (TSK), the 'fls' command lists files and directories within a disk image. The entry 'V/V 113-128-1: $OrphanFiles' is a virtual directory that contains files that have no parent directory in the file system, typically because their directory entries were deleted or corrupted. This is a common artifact when recovering deleted files from NTFS volumes, as TSK collects such orphaned MFT entries into this virtual container.

Answer

It is a sign that a rootkit has hidden files in the image

Answer

It indicates the location of the Master File Table (MFT) mirror

Answer

It is a standard NTFS metadata file that stores file permissions

Question 20

Which TWO of the following are common indicators of a rootkit infection on a Windows system?

Accepted Answer

System calls returning inconsistent results. Option B is correct because rootkits operate at the kernel level, intercepting system calls to hide their presence. When a system call (e.g., NtQuerySystemInformation) is invoked, the rootkit modifies the return data to exclude malicious processes or files, causing the results to be inconsistent with the actual system state. This is a classic symptom of a kernel-mode rootkit that has hooked the System Service Dispatch Table (SSDT).

Answer

High CPU usage by svchost.exe

Answer

Unexpected open ports on the firewall

Answer

Presence of unsigned kernel drivers