CHFI Network and Cloud Forensics — 15 Questions

Question 1

A forensic analyst is investigating a network breach and finds that the attacker used a technique that bypasses Network Access Control (NAC). Which of the following methods is commonly used to evade 802.1X authentication?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

MAC address spoofing. MAC address spoofing is a common way to bypass Network Access Control (NAC) when the system relies on MAC-based authentication or port security, such as MAC Authentication Bypass (MAB) or MAC filtering. Although standard 802.1X uses EAP, not MAC address, for authentication, many NAC implementations combine 802.1X with MAC-based fallbacks. By spoofing the MAC address of an already-approved device, an attacker can impersonate it and gain network access without valid credentials. Additionally, after a device authenticates via 802.1X, the switch may bind the port to that MAC address; spoofing that MAC would allow an attacker to reuse the port.

Answer

VLAN hopping using double tagging

Answer

DNS tunneling to exfiltrate data

Answer

ARP poisoning to redirect traffic

Question 2

An organization uses a cloud-based SIEM to collect logs from multiple sources. The investigator notices gaps in the log data for a critical system during the incident timeframe. What is the MOST likely cause?

Accepted Answer

Time drift between the system and the SIEM. Time drift between the system and the SIEM causes logs to be timestamped incorrectly, leading to apparent gaps when the SIEM queries by time range. Even if logs are delivered, they may fall outside the incident timeframe in the SIEM's index, creating the illusion of missing data. This is a common issue in cloud-based SIEMs where NTP synchronization is not enforced across all sources.

Answer

Network latency delayed log delivery

Answer

Log rotation policy deleted logs prematurely

Answer

The system's log level was set to ERROR only

Question 3

Which TWO of the following are common challenges in cloud forensics?

Accepted Answer

Jurisdictional and legal issues due to data stored in multiple regions. Cloud forensic investigations often involve data stored across multiple geographic regions, each with its own data protection laws (e.g., GDPR, CLOUD Act). This creates jurisdictional conflicts regarding lawful access, data privacy, and chain of custody, which are not present in traditional on-premises forensics.

Answer

All cloud environments provide the same forensic capabilities

Answer

Easier evidence acquisition compared to traditional forensics

Answer

Physical access to the hard drive is always available

Question 4

Which THREE of the following are essential steps in network forensic investigation?

Accepted Answer

Create a timeline of network events. Creating a timeline of network events (Option B) is essential in network forensic investigation because it establishes a sequence of activities, correlating packet captures, logs, and system events to reconstruct the attack path. This chronological mapping is critical for identifying the initial compromise point, lateral movement, and data exfiltration, often using tools like Wireshark or tcpdump with timestamps from NTP-synchronized sources.

Answer

Conduct interviews with all network users

Answer

Perform a bit-for-bit copy of all hard drives

Question 5

Which TWO of the following are effective methods for detecting a man-in-the-middle attack on a network?

Accepted Answer

Check for SSL certificate mismatches. SSL certificate mismatches occur when a man-in-the-middle (MITM) attacker presents a forged or self-signed certificate that does not match the legitimate server's certificate. Browsers and security tools will flag this mismatch (e.g., different Common Name, invalid issuer, or expired validity), providing a clear indicator of an ongoing MITM attack. Monitoring for ARP cache poisoning is also an effective detection method because MITM attackers often use ARP spoofing to intercept network traffic. By detecting anomalies in ARP tables (e.g., duplicate IP addresses with different MAC addresses), security tools can identify an ongoing MITM attack on the local network.

Answer

Analyze DNS amplification traffic

Answer

Implement port knocking for access control

Answer

Detect ICMP flood attacks

Question 6

An investigator finds the above IAM policy attached to an S3 bucket. What is the security concern?

Accepted Answer

The bucket is publicly accessible to read objects. The IAM policy's `Principal` is set to `"*"` (wildcard), which means any unauthenticated user or anonymous entity on the internet can perform the `s3:GetObject` action. This makes the S3 bucket publicly readable, exposing all objects stored in the bucket to anyone who knows the bucket name and object key. The `Effect` is `Allow` and there is no condition restricting access, so the policy grants open read access to the entire bucket.

Answer

The resource does not include all objects

Answer

The policy version is outdated

Answer

The policy allows anyone to write objects to the bucket

Question 7

You are a forensic investigator for a healthcare organization that uses a hybrid cloud model. Your team receives an alert that a large amount of protected health information (PHI) was exfiltrated from an AWS S3 bucket to an external IP address. The organization uses AWS CloudTrail for API logging and VPC Flow Logs for network traffic. The incident occurred between 02:00 and 03:00 UTC. Upon reviewing CloudTrail logs, you see that the bucket policy was modified at 01:55 UTC to allow public read access, and then a series of GetObject requests from an IP address in a foreign country occurred. The VPC Flow Logs show outbound traffic from the bucket's VPC to that IP. The bucket policy change was made using the root user credentials of the AWS account. The organization has multi-factor authentication (MFA) enabled for all users, including root. However, the CloudTrail log for the policy change does not indicate MFA usage. You need to determine the most likely root cause of the breach. Which of the following is the most plausible explanation?

Accepted Answer

The root user's credentials were compromised and used to modify the bucket policy. The root user credentials were likely compromised because the CloudTrail log for the bucket policy change at 01:55 UTC shows no MFA usage, despite MFA being enforced for all users including root. This indicates the attacker used stolen root access keys or password without the MFA token, which is a common attack vector when credentials are phished or leaked. The subsequent GetObject requests from a foreign IP and outbound VPC Flow Logs confirm the exfiltration path.

Answer

The bucket policy was automatically modified by an AWS service

Answer

An insider with IAM permissions made the change using a legitimate session

Answer

The CloudTrail logs are inaccurate and the policy change was not made

Question 8

During a forensic investigation of a cloud environment, a forensic analyst discovers that the virtual machine (VM) used by a suspect was terminated three days prior. The cloud provider offers snapshots, backups, and instance metadata. Which of the following is the BEST course of action to recover forensic evidence?

Accepted Answer

Restore the VM from a recent snapshot or backup provided by the cloud provider.. Once a VM is terminated, its underlying instance store or ephemeral disks are destroyed, but persistent snapshots and backups retain the disk state at the time they were taken. Restoring from a recent snapshot or backup is the only reliable method to recover the VM's file system, application data, and user artifacts for forensic analysis in a cloud environment.

Answer

Examine CloudTrail logs for disk contents.

Answer

Access the VM’s operating system via the cloud console’s serial console.

Answer

Use SSH credentials from the investigation to connect to the terminated instance.

Question 9

A forensic investigator needs to capture network traffic from a SPAN port on a switch to analyze an ongoing compromise. Which tool should the investigator use to collect the full packet capture (pcap) for later analysis?

Accepted Answer

tcpdump. tcpdump is a command-line packet capture utility that captures raw network traffic at the link layer, making it ideal for collecting full packet captures (PCAP) from a SPAN port. Unlike GUI tools, it can run headless on a forensic workstation and write binary PCAP files for later analysis with tools like Wireshark. It captures all packets traversing the SPAN port without filtering by default, ensuring a complete record of the compromise.

Answer

NetFlow

Answer

nmap

Answer

Wireshark

Question 10

A cloud forensic analyst is tasked with preserving evidence from an AWS S3 bucket that may contain malicious files. The bucket is publicly accessible, and the analyst wants to create a forensically sound copy. Which method BEST ensures integrity and chain of custody?

Accepted Answer

Use the AWS CLI sync command with the --checksum-mode flag to verify integrity during transfer.. The AWS CLI `sync` command with the `--checksum-mode` flag automatically computes and compares checksums (e.g., SHA256) during the transfer, ensuring data integrity without manual intervention. This method also preserves metadata and timestamps, which is critical for maintaining a forensically sound copy and chain of custody in cloud forensics.

Answer

Download each object via the AWS Management Console and compute SHA256 hashes manually.

Answer

Use the AWS CLI cp command recursively without any flags.

Answer

Generate a presigned URL for the bucket and use wget to download all files.

Question 11

Which TWO of the following are valid techniques for collecting volatile network evidence from a live system during incident response?

Accepted Answer

Running netstat -an to view active TCP/UDP connections.. `netstat -an` displays all active TCP and UDP connections along with their listening ports and states, which is critical for identifying unauthorized or malicious network connections on a live system. This command provides a snapshot of current network sessions without altering system state, making it a standard volatile evidence collection technique.

Answer

Using route print to view the IP routing table.

Answer

Using ipconfig /displaydns to view the DNS resolver cache.

Answer

Running arp -a to view the ARP table.

Question 12

During a cloud forensic investigation of an AWS EC2 instance, which TWO sources should be preserved to capture volatile data before instance termination?

Accepted Answer

Memory dump of the instance. A memory dump of the EC2 instance captures RAM contents, including running processes, network connections, encryption keys, and other volatile data that is lost when the instance is terminated. This is critical for forensic analysis of live system state. An EBS snapshot preserves the root and data volumes, providing a point-in-time copy of the file system and persistent storage, which is also lost upon termination.

Answer

VPC flow logs

Answer

S3 server access logs

Answer

AWS CloudTrail logs

Question 13

You are investigating a network breach at a financial institution. The perimeter firewall logs show an inbound connection from IP 203.0.113.5 to the internal web server (192.168.1.10) on TCP port 443 at 02:34:12 UTC. At 02:34:15, an outbound connection from the web server to an external IP 198.51.100.20 on TCP port 80 is logged. Simultaneously, a network intrusion detection system (NIDS) detected a SQL injection payload in the inbound HTTP request. The web server's access logs show a successful login to the admin panel at 02:34:18 from the same external IP 203.0.113.5. The database server (192.168.1.20) logs show a query execution at 02:34:20 that exported customer records. The company uses a jump box for administrative access, and all admin sessions are logged. The jump box logs show no activity during the incident. The web server hosts a public-facing application and is in a DMZ. The database server is in the internal network, with a firewall rule allowing only the web server to connect to it on TCP port 3306. Which course of action is MOST appropriate to determine the root cause and scope?

Accepted Answer

Correlate the database server logs with the web server logs to identify which records were queried and verify if they were exfiltrated via the outbound HTTP connection.. Correlating the database server logs with the web server logs allows you to identify exactly which customer records were queried and then cross-reference that with network logs—including the outbound connection to 198.51.100.20 on port 80—to determine if data was exfiltrated, taking into account the timeline of events. This approach directly addresses the root cause (SQL injection) and the scope (which records were compromised and whether they left the network).

Answer

Immediately isolate the web server from the network to prevent further data exfiltration, then perform memory forensics to find any malware.

Answer

Check the NTP logs to see if the timestamps are accurate, as the attack may be a time-based SQL injection.

Answer

Extract and analyze the full packet capture from the firewall to identify the SQL injection payload and any encrypted traffic.

Question 14

Drag and drop the steps to create a forensic timeline using the Sleuth Kit (TSK) and log2timeline into the correct order.

Accepted Answer

First, use fls to list files and directories. Second, use ils to extract inode information. Third, use mac-robber to create a body file with MAC timestamps. Fourth, use log2timeline to parse the body file and generate a timeline.. Creating a forensic timeline with TSK and log2timeline involves first collecting file system metadata using fls and ils to list files and inode details, then using mac-robber to capture MAC timestamps into a body file, and finally using log2timeline to parse the body file along with other evidence to generate a comprehensive timeline. This ensures all relevant artifacts are included in the correct chronological order.

Answer

First, use log2timeline to parse the disk image. Second, use mac-robber to collect MAC timestamps. Third, use fls to list files. Fourth, use ils to get inode details.

Answer

First, use ils to extract inode information. Second, use fls to list files. Third, use mac-robber to create a body file. Fourth, use log2timeline to parse.

Answer

First, use mac-robber to collect MAC timestamps. Second, use log2timeline to parse. Third, use fls to list files. Fourth, use ils to get inode details.

Question 15

Match each forensic artifact to its location in Windows (typical).

Accepted Answer

Prefetch files: C:\Windows\Prefetch. Typical Windows forensic artifact locations: Prefetch (.pf) in Prefetch folder, SAM hive in config, event logs in winevt\Logs, and Recycle Bin in $Recycle.Bin. Common confusions include swapping hive locations or using Temp for Prefetch.

Answer

Registry SAM hive: C:\Windows\System32\config\SYSTEM

Answer

Prefetch files: C:\Windows\Temp