CHFI Multiple Select — 50 Questions

Question 1

Which TWO of the following are valid reasons for using a hardware write blocker during disk acquisition? (Choose two.)

Accepted Answer

It allows the source drive to be connected to a forensic workstation without risking modification. A hardware write blocker is a device that sits between the source drive and the forensic workstation, intercepting and blocking any write commands from the host operating system. This ensures that the source drive is connected in a read-only state, preventing any accidental modifications to the evidence during acquisition. Option C correctly identifies this core function of preserving the integrity of the source drive.

Answer

It compresses the acquired data to save storage space

Answer

It increases the speed of data acquisition

Answer

It creates a forensic image of the drive

Question 2

Which TWO of the following are valid techniques for collecting volatile network evidence from a live system during incident response?

Accepted Answer

Running netstat -an to view active TCP/UDP connections.. Option D is correct because `netstat -an` displays all active TCP and UDP connections along with their listening ports and states, which is critical for identifying unauthorized or malicious network connections on a live system. This command provides a snapshot of current network sessions without altering system state, making it a standard volatile evidence collection technique.

Answer

Using route print to view the IP routing table.

Answer

Using ipconfig /displaydns to view the DNS resolver cache.

Answer

Running arp -a to view the ARP table.

Question 3

A first responder is responding to a ransomware incident on a Windows server. Which TWO actions should be performed to preserve evidence? (Choose two.)

Accepted Answer

Power off the server to prevent further data encryption.. Option B is correct because powering off the server preserves the encrypted state of the disk and prevents the ransomware from continuing to encrypt additional files or communicate with its command-and-control server. In a ransomware incident, immediate shutdown halts the encryption process and preserves the volatile evidence on disk, such as the ransomware binary and encrypted files, for forensic analysis.

Answer

Run an antivirus scan to remove the ransomware.

Answer

Restore the system from backup to minimize downtime.

Answer

Disconnect the network cable immediately.

Question 4

Which THREE of the following are indicators of malware persistence via registry run keys? (Choose three.)

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce is a registry run key that executes programs once at user logon and then deletes the entry. Malware often uses this key to run a payload a single time, such as during initial infection or after a reboot, to establish persistence without leaving a continuous trace in the Run key.

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Question 5

Which THREE of the following are essential steps in the incident response process as defined by NIST SP 800-61? (Select exactly 3.)

Accepted Answer

Post-Incident Activity. Option B is correct because Post-Incident Activity is one of the four core phases in the NIST SP 800-61 incident response lifecycle. This phase includes lessons learned, evidence retention, and report generation to improve future response efforts. Without this step, the organization cannot close the loop on security incidents or refine their detection and response capabilities.

Answer

Vulnerability Assessment

Answer

Penetration Testing

Question 6

Which TWO of the following are considered essential steps in the computer forensics investigation process according to EC-Council guidelines?

Accepted Answer

Identification of potential evidence. Identification of potential evidence is a core initial step in the EC-Council's computer forensics investigation process because it defines the scope and sources of data that may contain relevant evidence. Without proper identification, investigators risk missing critical data or collecting irrelevant information, which can compromise the entire investigation. This step involves recognizing potential evidence sources such as hard drives, network logs, and volatile memory, ensuring that all relevant data is accounted for before collection begins.

Answer

Data recovery from damaged media

Answer

Deletion of irrelevant data

Answer

Public disclosure of findings

Question 7

Which THREE of the following are recommended practices for maintaining the integrity of digital evidence in a forensics lab?

Accepted Answer

Maintain a detailed chain of custody log. Maintaining a detailed chain of custody log (Option A) is a recommended practice because it provides a verifiable, chronological record of every person who handled the evidence, the time and date of each transfer, and the purpose of each transfer. This ensures the evidence's integrity by demonstrating that it has not been tampered with or altered from the moment of seizure through analysis and presentation in court. Without a proper chain of custody, the evidence can be challenged as inadmissible under rules like Federal Rule of Evidence 901.

Answer

Perform regular backups of all evidence

Answer

Run antivirus scans on evidence before analysis

Question 8

Which THREE of the following are essential steps in network forensic investigation?

Accepted Answer

Create a timeline of network events. Creating a timeline of network events (Option B) is essential in network forensic investigation because it establishes a sequence of activities, correlating packet captures, logs, and system events to reconstruct the attack path. This chronological mapping is critical for identifying the initial compromise point, lateral movement, and data exfiltration, often using tools like Wireshark or tcpdump with timestamps from NTP-synchronized sources.

Answer

Conduct interviews with all network users

Answer

Perform a bit-for-bit copy of all hard drives

Question 9

Which TWO of the following are effective methods for detecting a man-in-the-middle attack on a network?

Accepted Answer

Check for SSL certificate mismatches. SSL certificate mismatches occur when a man-in-the-middle (MITM) attacker presents a forged or self-signed certificate that does not match the legitimate server's certificate. Browsers and security tools will flag this mismatch (e.g., different Common Name, invalid issuer, or expired validity), providing a clear indicator of an ongoing MITM attack. This is a direct detection method because the attacker cannot easily obtain a valid certificate for the target domain without the private key.

Answer

Analyze DNS amplification traffic

Answer

Implement port knocking for access control

Answer

Detect ICMP flood attacks

Question 10

Which TWO of the following are valid methods for collecting volatile data from a live database server during an incident response?

Accepted Answer

Execute netstat -an to list active network connections. Option D is correct because `netstat -an` lists all active network connections and listening ports without performing DNS resolution, which is critical for identifying unauthorized connections or ongoing data exfiltration from the live database server. This command retrieves data from the kernel's network stack, which is volatile and would be lost if the system were powered down.

Answer

Extract the file system journal

Answer

Take a backup of the database using mysqldump

Answer

Create a forensic image of the hard disk

Question 11

Which THREE of the following are essential steps in the forensic analysis of a compromised web application that uses a MySQL backend?

Accepted Answer

Check for suspicious stored procedures, triggers, or user-defined functions. Option C is correct because stored procedures, triggers, and user-defined functions (UDFs) in MySQL can be maliciously created or modified by an attacker to execute arbitrary code, escalate privileges, or maintain persistence. Forensic analysis must inspect these objects for unauthorized changes, as they are often overlooked but can contain backdoor logic that survives database restarts and backups.

Answer

Restore the database from the latest backup to ensure data integrity

Answer

Immediately change all database user passwords to prevent further access

Question 12

Which THREE of the following are best practices for conducting malware forensics in a safe and effective manner?

Accepted Answer

Use a dedicated forensic workstation that is not connected to any network. Option A is correct because a dedicated forensic workstation that is not connected to any network prevents the malware from communicating with command-and-control (C2) servers, exfiltrating data, or spreading to other systems. This isolation ensures the integrity of the analysis environment and protects the broader infrastructure from accidental infection or data leakage.

Answer

Delete the malware sample after analysis to prevent accidental infection

Answer

Run all analysis using the same tools and versions as the attacker

Question 13

Which TWO of the following are common indicators of a rootkit infection on a Windows system?

Accepted Answer

System calls returning inconsistent results. Option B is correct because rootkits operate at the kernel level, intercepting system calls to hide their presence. When a system call (e.g., NtQuerySystemInformation) is invoked, the rootkit modifies the return data to exclude malicious processes or files, causing the results to be inconsistent with the actual system state. This is a classic symptom of a kernel-mode rootkit that has hooked the System Service Dispatch Table (SSDT).

Answer

High CPU usage by svchost.exe

Answer

Unexpected open ports on the firewall

Answer

Presence of unsigned kernel drivers

Question 14

Which TWO of the following are valid locations in a Windows system where forensic evidence of USB device connection can be found?

Accepted Answer

SYSTEM\CurrentControlSet\Enum\USBSTOR registry key. The SYSTEM\CurrentControlSet\Enum\USBSTOR registry key is a primary location where Windows records every USB storage device that has been connected to the system. Each device is listed under this key with a unique instance ID, including the vendor ID, product ID, and serial number, providing persistent evidence of USB connections even after the device is removed.

Answer

Amcache.hve file

Answer

Event Logs with source 'Device Setup'

Answer

C:\Windows\Prefetch folder

Question 15

A mobile forensic examiner is analyzing an Android device that has been factory reset. Which TWO of the following artefacts are MOST likely to still be recoverable after a factory reset? (Select TWO)

Accepted Answer

SMS messages. SMS messages (A) are stored in the Android internal database file `/data/data/com.android.providers.telephony/databases/mmssms.db`. A factory reset typically only marks the database file's storage blocks as free in the ext4 filesystem without performing a secure wipe, leaving the raw data recoverable via forensic tools like Cellebrite or Oxygen Forensic until overwritten. Google account tokens (D) are stored in the AccountManager service's SQLite database under `/data/system/users/0/accounts.db` and in the `authtoken` table; even after a factory reset, the underlying NAND flash memory may retain these tokens due to wear-leveling and garbage collection delays, allowing recovery with chip-off or JTAG techniques.

Answer

Deleted applications' data

Answer

Call logs

Answer

Photos stored in internal storage

Question 16

An analyst is investigating a potential data breach on an Android device. Which TWO artefacts are MOST useful for determining which third-party apps were installed and used? (Select TWO.)

Accepted Answer

packages.xml file in /data/system/. The packages.xml file in /data/system/ records all installed packages, including third-party apps, their permissions, and installation metadata. The /data/data/ directory contains per-package subdirectories with application-specific data, confirming actual usage and stored data. Together, these two artefacts provide definitive evidence of which third-party apps were installed and used on the device.

Answer

Full system dump (dd image)

Answer

Wi-Fi connection logs

Answer

SMS database (mmssms.db)

Question 17

During dynamic analysis of a malware sample, an analyst observes the following: creation of a mutex named `Global\{9A2D7E1C-3F4B-4A5E-9B8C-1D2E3F4A5B6C}`, a registry key under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` named `WindowsUpdate`, and outbound TCP traffic to `203.0.113.5:443`. Which THREE of the following indicators of compromise (IoCs) should be documented?

Accepted Answer

Outbound TCP to `203.0.113.5:443`. Option A is correct because outbound TCP traffic to a specific IP address and port (203.0.113.5:443) is a classic network-based indicator of compromise (IoC). During dynamic analysis, this demonstrates the malware's command-and-control (C2) communication, often using HTTPS over port 443 to blend with legitimate traffic. Documenting this IoC allows defenders to block the endpoint and detect similar infections via network monitoring.

Answer

SHA256 hash of the malware sample

Answer

File path `C:\Windows\System32
otepad.exe`

Question 18

Which TWO of the following are anti-forensic techniques used by malware to evade detection?

Accepted Answer

Packing. Packing is an anti-forensic technique that compresses or encrypts the malware's executable code, making static analysis difficult by obfuscating the original binary signature and strings. This allows malware to evade signature-based detection by antivirus and forensic tools until the packed code is unpacked at runtime.

Answer

Logging errors

Answer

Encryption of communication

Answer

Creating mutexes

Question 19

A forensic analyst is examining an Android device using ADB extraction. Which TWO statements about ADB extraction are true?

Accepted Answer

ADB extraction requires USB debugging to be enabled on the device. ADB (Android Debug Bridge) extraction requires USB debugging to be enabled on the device because ADB operates over a USB connection using the Android Debug Bridge protocol, which is only active when USB debugging is turned on in Developer Options. Without this setting, the device will not respond to ADB commands, making extraction impossible. This is a fundamental prerequisite for any ADB-based forensic acquisition.

Answer

ADB extraction allows full file system access without root

Answer

ADB extraction can acquire a physical image of the device

Answer

ADB extraction can recover deleted files from unallocated space

Question 20

An incident responder is analyzing a compromised Windows workstation. Which TWO artifacts would provide the STRONGEST evidence of a malware persistence mechanism?

Accepted Answer

Registry Run key referencing a suspicious path. The Registry Run key (e.g., `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`) is a classic and widely used persistence mechanism. A suspicious path under this key directly indicates that the malware is configured to execute automatically at user logon, providing strong evidence of persistence. This is a core artifact in Windows forensics for identifying auto-starting malware.

Answer

Event log entry for user login

Answer

Network share access logs

Answer

Browser history showing download of a suspicious file