CHFI Incident Response and First Responder Skills — 20 Questions

Question 1

An analyst receives an alert indicating a suspicious process (PID 3342) is making outbound connections on port 443 to an unknown IP. The system is a Windows 10 workstation. Which first responder action is MOST appropriate?

Accepted Answer

Capture a full memory dump using a tool like FTK Imager (Memory Capture) or DumpIt.. Capturing a full memory dump (option A) is the most appropriate first responder action because it preserves the volatile state of the suspicious process (PID 3342) and its associated artifacts (e.g., network connections, loaded DLLs, encryption keys) before any further system changes occur. This allows forensic analysis to identify the malware's behavior, such as command-and-control (C2) communication over port 443 (HTTPS), without altering evidence. Tools like FTK Imager (Memory Capture) or DumpIt acquire a raw .mem file that can be analyzed with Volatility or Rekall to extract process details, network sockets, and injected code.

Answer

Immediately disconnect the system from the network to contain the threat.

Answer

Check the Windows Event Logs for related entries.

Answer

Reboot the system to clear any malicious processes from memory.

Question 2

A security team suspects a data breach via an external attacker. The incident response plan requires preservation of evidence for legal proceedings. Which order of volatility should the first responder follow?

Accepted Answer

Capture memory, record network connections, acquire disk image, then collect backups.. Option C is correct because the order of volatility (OOV) dictates that the most volatile data (memory/registers) must be captured first, followed by network connections, then disk images, and finally backups. This sequence minimizes data loss and ensures evidence integrity for legal proceedings, as volatile data is lost when power is removed.

Answer

Capture disk image, then memory, then network connections.

Answer

Record network connections, capture disk image, then memory.

Answer

Collect backups first, then disk image, then memory.

Question 3

During an incident response, a first responder needs to collect evidence from a Linux server that is still running. The server has sensitive data and cannot be shut down. Which technique is BEST for acquiring a forensic image of the hard disk?

Accepted Answer

Use dd if=/dev/sda of=/mnt/evidence/image.dd bs=4M. Option B is correct because it uses dd with a 4M block size, which improves acquisition speed while still producing a bit-for-bit forensic image of the entire disk (/dev/sda). The conv=noerror,sync option in A is unnecessary for a live acquisition from a healthy disk and can mask read errors, while B's larger block size is more efficient for imaging a running system without shutdown.

Answer

Use dd if=/dev/sda of=/mnt/evidence/image.dd conv=noerror,sync

Answer

Use dd if=/dev/mapper/root of=/mnt/evidence/image.dd

Answer

Use dd if=/dev/sda1 of=/mnt/evidence/image.dd

Question 4

A first responder arrives at a scene where a computer is powered on and a user is logged in. An incident is suspected. What should the responder do FIRST?

Accepted Answer

Photograph the screen to document the current state.. Option C is correct because the first priority at a live incident scene is to preserve volatile evidence. Photographing the screen captures the current state of the system, including open applications, network connections, and user activity, which can be lost if the system is altered or powered down. This documentation provides a baseline for the investigation and ensures that critical volatile data is recorded before any forensic acquisition begins.

Answer

Begin capturing a memory dump using a forensic tool.

Answer

Power off the computer immediately to preserve the disk.

Answer

Ask the user to log off so the system can be imaged.

Question 5

You are responding to a suspected malware infection on a Windows 10 system. The system is still running. Which of the following should you collect FIRST?

Accepted Answer

Acquire a memory dump using a tool like WinPmem.. When a system is still running and suspected of malware infection, the first priority is to capture volatile data, which includes the contents of RAM. WinPmem is a tool designed to acquire a memory dump from a live Windows system, preserving critical evidence such as running processes, network connections, and injected code that would be lost on shutdown. This follows the order of volatility (RFC 3227), which mandates collecting memory before any non-volatile data like logs, registry, or disk images.

Answer

Collect the Windows Event Logs.

Answer

Export the contents of the Windows Registry.

Answer

Create a forensic image of the hard drive.

Question 6

During an incident response, a first responder needs to preserve the integrity of evidence. Which action ensures the best chain of custody?

Accepted Answer

Compute a SHA-256 hash of the acquired image immediately after collection and record it in the chain of custody form.. Option B is correct because computing a SHA-256 hash immediately after acquisition creates a cryptographic fingerprint of the image. This hash, when recorded in the chain of custody form, provides verifiable integrity: any subsequent alteration of the image will produce a different hash, proving tampering. While other steps are important, only hashing directly ties the evidence's integrity to a mathematical proof that can be independently verified later.

Answer

Use a write blocker when acquiring the disk image.

Answer

Document every person who handled the evidence.

Answer

Place the evidence in an evidence bag and lock it in a secure room.

Question 7

A first responder is called to investigate a potential insider threat. The suspect's computer is turned off. What is the BEST procedure?

Accepted Answer

Seize the computer and transport it to a forensic lab for imaging.. When a suspect's computer is already turned off, the best procedure is to seize it and transport it to a forensic lab for imaging. This preserves the integrity of the evidence by preventing any accidental modification of the hard drive's contents, which could occur if the system is powered on or booted from a live CD. In forensic best practices, the first responder should never boot a suspect's computer, as doing so can alter critical system files, timestamps, and volatile data, compromising the chain of custody and admissibility of evidence.

Answer

Compute a hash of the hard drive using a live CD.

Answer

Check the power cord and peripherals for tampering.

Answer

Turn on the computer to see if it boots normally.

Question 8

A first responder is responding to a ransomware incident on a Windows server. Which TWO actions should be performed to preserve evidence? (Choose two.)

Accepted Answer

Power off the server to prevent further data encryption.. Option B is correct because powering off the server preserves the encrypted state of the disk and prevents the ransomware from continuing to encrypt additional files or communicate with its command-and-control server. In a ransomware incident, immediate shutdown halts the encryption process and preserves the volatile evidence on disk, such as the ransomware binary and encrypted files, for forensic analysis.

Answer

Run an antivirus scan to remove the ransomware.

Answer

Restore the system from backup to minimize downtime.

Answer

Disconnect the network cable immediately.

Question 9

During the initial response to a suspected data exfiltration, which THREE pieces of volatile data should be collected first? (Choose three.)

Accepted Answer

Current network connections.. Current network connections (A) are volatile because they show active communication channels that could indicate data exfiltration in progress. If the system is shut down or disconnected, this evidence is lost immediately, making it a top priority for collection during initial response.

Answer

Windows registry hives.

Answer

Forensic image of the hard drive.

Question 10

Refer to the exhibit. A first responder runs netstat -ano on a Windows system. Which connection is MOST likely indicative of a potential C2 communication?

Accepted Answer

TCP 192.168.1.10:49153 to 203.0.113.50:443 TIME_WAIT PID 1204. Option C is correct because the connection from a high ephemeral port (49153) to an external IP (203.0.113.50) over HTTPS (port 443) with a short-lived TIME_WAIT state is a classic indicator of potential C2 beaconing. C2 communications often use HTTPS to blend with legitimate traffic, and the TIME_WAIT state suggests brief, periodic connections typical of beaconing, rather than sustained data transfer. The external IP is also in a documentation/test range (203.0.113.0/24), which is commonly used for examples but in a real scenario would be suspicious as an unknown external destination.

Answer

TCP 0.0.0.0:3389 LISTENING PID 668

Answer

TCP 192.168.1.10:49154 to 192.168.1.1:53 TIME_WAIT PID 2016

Answer

TCP 192.168.1.10:49152 to 10.0.0.5:80 ESTABLISHED PID 3342

Question 11

Refer to the exhibit. A first responder runs the command on a Linux server. Which process should be considered MOST suspicious and investigated immediately?

Accepted Answer

python /tmp/.payload.py (PID 1310). Option B is correct because the Python script located in /tmp/.payload.py (PID 1310) is a hidden file in a temporary directory, which is a common technique for storing malicious payloads. The command 'python /tmp/.payload.py' indicates execution of an arbitrary script, often used for reverse shells, data exfiltration, or persistence mechanisms, making it the most suspicious process in an incident response context.

Answer

/bin/bash (PID 1245)

Answer

nc -lvp 4444 (PID 1302)

Answer

perl /tmp/.script.pl (PID 1325)

Question 12

You are a first responder for a medium-sized company with 500 employees. The incident response team has been alerted to a possible data breach involving the CEO's laptop, which is a Windows 10 system. The CEO reports that the laptop has been acting strangely, with unusual pop-ups and slow performance. The laptop is currently powered on and connected to the corporate network via Wi-Fi. The CEO is logged in and has several applications open, including email and a web browser. The security team suspects malware may be exfiltrating sensitive documents. As the first responder, you must decide the best course of action to preserve evidence and contain the threat while minimizing impact on business operations. Which action should you take FIRST?

Accepted Answer

Capture a full memory dump using a forensic tool like FTK Imager or WinPmem.. The correct first action is to capture a full memory dump using a forensic tool like FTK Imager or WinPmem. Since the laptop is powered on and malware is suspected, volatile data (including running processes, network connections, and encryption keys) is at risk of being lost. Preserving RAM is the highest priority in live incident response because it contains evidence of active malware and ongoing exfiltration that would be lost upon shutdown or disconnection.

Answer

Disconnect the laptop from the corporate network immediately to stop any ongoing data exfiltration.

Answer

Create a forensic image of the hard drive using a write blocker.

Answer

Shut down the laptop to prevent further damage and preserve the disk.

Question 13

During incident response, a first responder discovers a compromised system with signs of an active command-and-control (C2) connection. What is the MOST important immediate action to preserve evidence and prevent further damage?

Accepted Answer

Disconnect the network cable to isolate the system from the network.. Option B is correct because disconnecting the network cable immediately stops the active C2 communication, preventing further data exfiltration and command injection while preserving the current state of memory and disk. This action maintains the integrity of volatile evidence (e.g., network connections, running processes) and avoids the data loss that would occur with a shutdown or the evidence contamination that would result from running a scan.

Answer

Create a full disk image before taking any other action.

Answer

Immediately shut down the system to prevent further data exfiltration.

Answer

Run a full antivirus scan to remove the malware.

Question 14

Which THREE of the following are essential steps in the incident response process as defined by NIST SP 800-61? (Select exactly 3.)

Accepted Answer

Post-Incident Activity. Option B is correct because Post-Incident Activity is one of the four core phases in the NIST SP 800-61 incident response lifecycle. This phase includes lessons learned, evidence retention, and report generation to improve future response efforts. Without this step, the organization cannot close the loop on security incidents or refine their detection and response capabilities.

Answer

Vulnerability Assessment

Answer

Penetration Testing

Question 15

Refer to the exhibit. During incident response, a first responder runs 'netstat -ano' on a compromised Windows system. Which connection is most likely to be the command-and-control (C2) channel and should be prioritized for isolation?

Accepted Answer

192.168.1.100:1045 to 203.0.113.5:4444 (ESTABLISHED). Option A shows an established connection from the internal host (192.168.1.100) to an external IP (203.0.113.5) on TCP port 4444, which is commonly associated with Metasploit reverse shells and other C2 frameworks. The ESTABLISHED state indicates an active, ongoing session, making it the highest priority for isolation during incident response.

Answer

192.168.1.100:1047 to 10.0.0.1:22 (ESTABLISHED)

Answer

192.168.1.100:1046 to 192.168.1.1:443 (ESTABLISHED)

Answer

192.168.1.100:1048 to 198.51.100.7:80 (TIME_WAIT)

Question 16

You are a first responder for a medium-sized enterprise. The Help Desk received multiple reports that users cannot access the company's internal web application (app.example.com) hosted on a Windows Server 2019 VM. The server is also running a MySQL database and an FTP service for file transfers. You remote into the server and find that the web server (IIS) is still running, but the application pool is stopped. The event logs show multiple failed logon attempts from an external IP address (198.51.100.23) for the local administrator account around the time the issues started. The FTP service log shows successful anonymous logins from the same IP minutes before the web app failure. The MySQL log shows a query 'DROP TABLE users;' executed at 03:15 AM. The current time is 04:00 AM. What immediate action should you take?

Accepted Answer

Capture a memory dump of the server, then disconnect the network cable, and then image the hard drive.. Option A is correct because the server is actively compromised — the attacker gained access via anonymous FTP, executed a destructive SQL query, and performed lateral movement. Capturing a memory dump preserves volatile evidence (e.g., running processes, network connections, and in-memory malware), disconnecting the network cable prevents further data exfiltration or remote control, and imaging the hard drive captures persistent evidence. This follows the CHFI first responder priority: preserve volatile data first, then isolate, then acquire non-volatile evidence.

Answer

Disconnect the server from the network and then restore the database from the last clean backup.

Answer

Immediately shut down the server to prevent further damage and then create a forensic image of the hard drive.

Answer

Run a full antivirus scan, then try to restart the application pool to restore service quickly.

Question 17

During the initial response to a suspected data breach, a first responder discovers a live system with active network connections. The responder needs to preserve evidence while minimizing alteration. Which of the following is the MOST appropriate first step?

Accepted Answer

Use a memory acquisition tool to capture the contents of RAM.. A is correct because in a live system with active network connections, the most volatile evidence is in RAM (e.g., running processes, network connections, encryption keys). Using a memory acquisition tool (like FTK Imager or WinPmem) captures this volatile data before any other action, preserving evidence that would be lost on shutdown or disconnection. This aligns with the order of volatility (RFC 3227), which prioritizes memory over disk.

Answer

Run a full disk imaging tool to capture the hard drive contents.

Answer

Disconnect the network cable to isolate the system from the network.

Answer

Immediately shut down the system by pulling the power cord.

Question 18

Which TWO actions are essential for a first responder when securing an incident scene involving a compromised server? (Select exactly two.)

Accepted Answer

Document the system’s date and time settings for accurate timeline reconstruction.. Option B is correct because the system's date and time settings are critical for establishing a reliable timeline of events during forensic analysis. The first responder must document these settings (e.g., from the BIOS or operating system) before any changes occur, as they directly affect the timestamps of file system metadata (MAC times) and log entries. Without this baseline, correlating events across multiple sources becomes unreliable, potentially invalidating the entire investigation.

Answer

Run antivirus scans to identify and remove any malware present.

Answer

Reboot the system into safe mode to prevent further damage.

Answer

Connect an external hard drive to create a backup of important files.

Question 19

Refer to the exhibit. A first responder runs the netstat command on a compromised Windows workstation. Which of the following conclusions is BEST supported by the output?

Accepted Answer

A process with PID 1234 is likely communicating with a remote C2 server at 10.2.3.4.. Option C is correct because an established TCP connection (ESTABLISHED state) from the workstation to a remote IP on a high ephemeral port (49152) with PID 1234 strongly indicates active communication. This is a classic indicator of a beaconing C2 channel, as legitimate outbound connections typically use well-known ports or are short-lived. The netstat output shows PID 1234 has a persistent connection to 10.2.3.4:4444, which is a common port for malware command and control.

Answer

The connection to 192.168.1.1:80 is suspicious because it is in TIME_WAIT state.

Answer

The UDP listener on port 5353 indicates a malware infection.

Answer

The workstation is running multiple virtual machines based on the local addresses.

Question 20

Drag and drop the steps to capture network traffic with Wireshark for forensic analysis into the correct order.