CHFI Multiple Select — 10 Questions

Question 1

In email forensics, which TWO of the following headers are most useful for identifying the true origin of an email? (Select TWO.)

Accepted Answer

X-Originating-IP. Received headers show the path and each server's IP, while X-Originating-IP may contain the sender's IP. DKIM verifies integrity but not origin IP. Message-ID is just an identifier.

Answer

Message-ID

Answer

DKIM-Signature

Answer

MIME-Version

Question 2

Which TWO of the following are indicators of a webshell on a web server? (Select TWO.)

Accepted Answer

The file contains system commands executed via GET or POST parameters. Webshells often have recent modification times out of sync with other files, and they typically accept command parameters in GET/POST requests. Large file size alone is not definitive, and missing index.html is unrelated.

Answer

A file named 'cmd.php' with a modification date matching other legitimate files

Answer

The server's index.html file is missing

Answer

The file is over 1 MB in size

Question 3

Which TWO artifacts are commonly used to identify USB device insertion history on a Windows system? (Select TWO.)

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR registry key and setupapi.dev.log contain information about USB devices connected to the system, including device IDs and timestamps.

Answer

NTUSER.DAT

Answer

prefetch files

Answer

Event ID 7045

Question 4

Which THREE of the following are challenges specific to container forensics? (Select THREE.)

Accepted Answer

Containers share the same kernel as the host, limiting isolation for forensic acquisition. Containers are ephemeral (volatile evidence), they share the host kernel (limited isolation), and they rely on layered images that must be analyzed. Standard disk imaging tools may not work; network isolation is not a specific challenge.

Answer

Network isolation prevents packet capture

Answer

Standard forensic imaging tools can be directly applied

Question 5

A cloud forensic investigator is analyzing a GCP audit log entry for a Compute Engine instance. Which THREE fields are essential for identifying the user and operation performed?

Accepted Answer

methodName. GCP audit logs include the principal email (authenticationInfo), operation type (methodName), and resource name (resourceName). IP address and user agent may be in requestMetadata but not always in every log entry.

Answer

requestMetadata.callerIp

Answer

requestMetadata.userAgent

Question 6

Which TWO of the following are requirements for evidence to be admissible in court? (Select two.)

Accepted Answer

Evidence must be reliable. The rules of evidence require that evidence be admissible, reliable, complete, and authentic. In many jurisdictions, evidence must be relevant and reliable to be admissible. Completeness and authenticity are also key.

Answer

Evidence must be encrypted

Answer

Evidence must be stored on a write-blocked drive

Answer

Evidence must be obtained by the police

Question 7

Which TWO of the following are valid email header fields that can be used to detect email spoofing? (Select 2)

Accepted Answer

Received-SPF. SPF and DKIM are email authentication mechanisms that help detect spoofing. SPF checks if the sending server is authorized, DKIM verifies the email integrity.

Answer

Subject

Answer

Content-Type

Answer

MIME-Version

Question 8

Which TWO of the following are appropriate techniques for identifying a webshell on a compromised web server?

Accepted Answer

Searching for files with recent creation or modification timestamps in the web root. Webshells are often detected by recent file timestamps and anomalous POST requests in logs.

Answer

Verifying SSL certificate validity

Answer

Running a full antivirus scan on the server

Answer

Checking for open ports on the server

Question 9

A forensic analyst reviews a Windows system for signs of malware persistence. Which TWO registry locations are commonly used to achieve persistence via auto-start programs?

Accepted Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKCU\Software\Microsoft\Windows\CurrentVersion\Run are standard auto-start locations for all users and current user respectively. RunOnce keys execute once and are also used. But the most common are Run keys.

Answer

HKLM\SAM\SAM\Domains\Account\Users

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Question 10

A forensic analyst is examining a Google Cloud Platform (GCP) environment after a security incident. Which TWO GCP services should the analyst use to audit API activity and resource changes? (Select TWO.)

Accepted Answer

Cloud Asset Inventory. Cloud Audit Logs record API calls and resource changes, while Cloud Asset Inventory tracks resource history and configuration changes.

Answer

Cloud Storage Object Change Notification

Answer

Cloud Monitoring

Answer

Cloud Functions