CHFI Multiple Select — 50 Questions

Question 1

Which TWO of the following are tools that can be used for timeline analysis in digital forensics?

Accepted Answer

log2timeline. log2timeline (option C) is a tool specifically designed for timeline analysis in digital forensics. It parses various log files and artifacts to create a super timeline, which is a comprehensive chronological record of system activity. This allows investigators to correlate events across multiple sources, such as file system timestamps, registry keys, and application logs.

Answer

Wireshark

Answer

Nmap

Answer

FTK Imager

Question 2

During a Windows forensic investigation, an analyst finds prefetch files with the .pf extension. Which TWO pieces of information can the analyst obtain from analyzing prefetch files?

Accepted Answer

The number of times the application has been executed. Prefetch files in Windows store execution count and timestamps of application launches. The .pf file header contains a run count field that increments each time the application is executed, and the file also records up to eight previous execution timestamps. This allows the analyst to determine how many times the application was run and the exact date and time of each execution, making A and B correct.

Answer

The username that executed the application

Answer

The command-line arguments used to launch the program

Answer

The IP addresses the application connected to

Question 3

Which THREE of the following are types of slack space that can contain hidden data on a hard disk?

Accepted Answer

File slack. File slack (C) is correct because it refers to the unused space between the end of a file's data and the end of the allocated cluster. This area can contain remnants of previous file data or intentionally hidden data, and is a standard forensic artifact in file system analysis (e.g., NTFS or FAT).

Answer

Device Configuration Overlay

Answer

Host Protected Area

Question 4

Which TWO Windows Event IDs are associated with successful logon or explicit credential usage? (Choose TWO.)

Accepted Answer

4648. Event ID 4648 is logged when a user attempts to log on using explicit credentials, such as running a program as a different user or using the 'runas' command. Event ID 4624 is logged for every successful local or remote logon session, including interactive, network, and service logons. Both are standard Windows Security log events used in forensic analysis to track authentication activity.

Answer

4720

Answer

4625

Answer

7045

Question 5

Which TWO of the following are essential components of a proper chain of custody documentation? (Select TWO)

Accepted Answer

Date and time of evidence collection. The date and time of evidence collection is a fundamental element of chain of custody documentation, establishing a precise chronological record of when the evidence was acquired. This timestamp is critical for proving the integrity and continuity of the evidence from the moment of seizure, and it must be recorded with accuracy (often to the second) and in a consistent time zone (e.g., UTC) to avoid disputes. Without this, the chain of custody cannot demonstrate that the evidence was not tampered with between collection and analysis.

Answer

The IP address of the forensic workstation

Answer

Backup location of the evidence

Answer

The forensic tool used to analyze the evidence

Question 6

A forensic examiner has acquired a disk image using FTK Imager and needs to ensure the image is an exact duplicate of the original drive. Which THREE of the following methods can be used to verify integrity? (Select THREE)

Accepted Answer

Compute the SHA-256 hash of the image and compare it to the original drive's hash. SHA-256 is a cryptographic hash function that produces a unique 256-bit digest. By computing the SHA-256 hash of the acquired image and comparing it to the hash computed from the original drive, the examiner can verify bit-for-bit integrity with extremely high collision resistance, ensuring the image is an exact duplicate.

Answer

Verify the cyclical redundancy check (CRC-32) of the image file

Answer

Check the file size of the image matches the original drive's capacity

Question 7

Which FOUR of the following are persistence mechanisms that can be used on Linux systems?

Accepted Answer

SSH authorized keys. Persistence mechanisms on Linux include SSH authorized keys (B), which allow an attacker to maintain remote access by adding their public key to the target user's authorized_keys file; startup scripts in /etc/init.d (C), which execute at boot; cron jobs (D), which run scheduled tasks; and modifications to /etc/passwd (E) to create persistent user accounts. Prefetch files (A) are Windows-specific and not a Linux persistence mechanism.

Answer

Prefetch files

Question 8

A forensic analyst is investigating a Windows system for persistence mechanisms. Which TWO registry locations are commonly used by malware to achieve auto-start? (Select TWO.)

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard auto-start location where malware can add entries to execute programs when a user logs in. This key is commonly abused because it does not require administrative privileges to modify, making it a frequent persistence mechanism for user-level malware.

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKLM\SAM\SAM

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Question 9

Which TWO of the following are valid techniques for acquiring RAM in a Windows system?

Accepted Answer

WinPmem. WinPmem is a dedicated memory acquisition tool for Windows that uses the WinPmem driver to access physical memory directly, bypassing OS protections. It is widely used in forensic acquisitions because it can capture RAM with minimal interference and supports both 32-bit and 64-bit Windows systems.

Answer

Sleuth Kit

Answer

LiME

Answer

dd

Question 10

Which TWO of the following are considered types of evidence under the rules of evidence?

Accepted Answer

Direct evidence. Direct evidence (Option B) is a type of evidence under the rules of evidence because it directly proves a fact without requiring any inference or presumption. In computer forensics, this could include a log entry showing an unauthorized login from a specific IP address at a specific time, which directly proves the fact of access. The rules of evidence recognize direct evidence as primary proof that stands on its own.

Answer

Best evidence rule

Answer

Hearsay evidence

Answer

Exculpatory evidence

Question 11

During a forensic investigation of a Windows 10 system, you need to analyze the file system to recover deleted files. Which TWO file system artifacts would be most useful for this purpose?

Accepted Answer

$LogFile. $LogFile (A) records metadata changes to the NTFS volume, including transactions that can be replayed to recover file names and directory entries for recently deleted files. $MFT (C) contains the master file table entries for every file and directory; even after deletion, the MFT entry often remains until overwritten, allowing recovery of file attributes and data runs.

Answer

$Boot file

Answer

$Volume

Answer

$Bitmap

Question 12

During dynamic analysis of a malware sample in a sandbox, an analyst observes the following behaviours: (1) A file is created at C:\Windows\System32\drivers\etc\hosts, (2) A registry key is set at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateSvc, (3) Outbound TCP connections to 198.51.100.10 on port 8080. Which THREE of the following IoCs are MOST relevant to share with the threat intelligence team?

Accepted Answer

Network connection to 198.51.100.10:8080. The outbound TCP connection to 198.51.100.10 on port 8080 is a direct network-based indicator of compromise (IoC) that threat intelligence teams can use to block or monitor malicious C2 traffic. This IP and port combination represents a specific command-and-control endpoint, making it highly actionable for network defense and threat hunting.

Answer

MD5 hash of the original malware file

Answer

Mutex name created by the malware

Question 13

A malware analyst is performing dynamic analysis of a trojan. Which THREE of the following tools are commonly used to monitor system changes during execution?

Accepted Answer

Process Monitor. Process Monitor (A) is correct because it is a real-time system monitoring tool that captures file system, registry, and process/thread activity, allowing analysts to observe changes made by a trojan during execution. It uses kernel-mode drivers to log operations such as CreateFile, RegSetValue, and CreateProcess, which are essential for dynamic analysis.

Answer

Ghidra

Answer

PEiD

Question 14

A malware analyst is performing static analysis on a packed executable. Which THREE techniques are effective for unpacking or analyzing packed malware? (Select THREE.)

Accepted Answer

Performing strings analysis on the packed binary. Performing strings analysis on a packed binary can reveal embedded strings, such as import hints, configuration data, or the original entry point (OEP), which may survive packing. While packing obfuscates many strings, some packers leave remnants that static analysis tools like `strings` can extract, providing initial clues about the malware's functionality without execution.

Answer

Renaming the file to .txt

Answer

Executing the sample in Cuckoo Sandbox

Question 15

An investigator is analyzing email headers and notices the following: The 'Received' headers show a path through multiple servers, the 'DKIM-Signature' domain matches the sender domain, and 'X-Originating-IP' is present. Which TWO pieces of information are MOST useful to trace the original sender's IP address? (Choose two.)

Accepted Answer

The X-Originating-IP header value. The X-Originating-IP header is explicitly added by some mail servers (e.g., Microsoft Exchange) to record the originating IP of the client that submitted the message, making it a direct source for the sender's IP. The last (bottommost) Received header represents the first hop from the sender's mail client or server, as each receiving server prepends its own Received header, so the bottommost one contains the IP of the initial connecting host.

Answer

The 'Message-ID' header

Answer

The 'From' header email address

Answer

The DKIM-Signature's 'd=' domain

Question 16

Which TWO of the following are valid methods to hide data on an NTFS file system without using external tools?

Accepted Answer

Embedding data in file slack space. A is correct because file slack space is the unused bytes between the end of a file's logical data and the end of its allocated cluster. On NTFS, when a file does not fill its last cluster, the remaining bytes (RAM slack and drive slack) can be written to without affecting the file's visible content. This is a native hiding method that requires no external tools, as the data is simply written to the slack region using standard file I/O operations.

Answer

Storing data in the NTFS file system journal ($LogFile)

Answer

Using the $Volume attribute in the MFT

Answer

Encrypting data with EFS

Question 17

Which TWO tools are commonly used for static analysis of malware binaries?

Accepted Answer

IDA Pro. IDA Pro is a leading interactive disassembler and debugger used for static analysis of malware binaries. It allows analysts to examine executable code without executing it, by disassembling machine code into assembly language and providing cross-references, function graphs, and decompilation capabilities. This makes it essential for reverse engineering malicious software to understand its logic, embedded strings, and control flow.

Answer

Cuckoo Sandbox

Answer

Wireshark

Answer

Process Monitor

Question 18

Which THREE of the following are indicators of a webshell compromise on a web server?

Accepted Answer

High CPU usage from web server processes. A webshell often executes malicious commands via the web server's process (e.g., Apache's httpd or IIS's w3wp.exe). This causes sustained high CPU usage because the webshell may be running resource-intensive tasks like password cracking, data exfiltration, or cryptomining within the web server's process context, which is a strong indicator of compromise.

Answer

Regular successful logins to the server with correct credentials

Answer

Decrease in network traffic

Question 19

A forensic analyst is investigating a Windows system for evidence of malware persistence. Which TWO registry locations are commonly used by malware to automatically execute on system startup?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Services. D is correct because the HKLM\SYSTEM\CurrentControlSet\Services registry key stores configuration for Windows services, including the ImagePath value that specifies the executable to run. Malware often installs as a service to achieve automatic execution at system startup, as services are started by the Service Control Manager (SCM) during boot, independent of user logon.

Answer

HKLM\SAM

Answer

C:\Windows\Prefetch

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellBags

Question 20

Which THREE of the following are common challenges specific to cloud forensics? (Select THREE)

Accepted Answer

Data jurisdiction and legal compliance across regions. Cloud forensic investigations must navigate data jurisdiction and legal compliance issues when data is stored across multiple geographic regions, each with its own data protection laws (e.g., GDPR, CLOUD Act). This creates challenges in obtaining lawful access to data that may be physically located in a jurisdiction where the investigator has no legal authority.

Answer

Lack of standardized log formats

Answer

High cost of forensic tools