CHFI Network and Cloud Forensics Practice Test 2 — 15 Questions

Question 1

A forensic investigator is analyzing a compromised Linux web server. The server's network interface was in promiscuous mode, and a full packet capture was running via tcpdump when the attacker exfiltrated data over HTTPS. The investigator needs to determine the exact bytes transferred during the exfiltration session. Which artifact from the packet capture will BEST provide this information?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The reassembled TCP stream payload. Reassembling the TCP stream from the packet capture reconstructs the application-layer payload, allowing the investigator to extract the exact bytes transferred during the HTTPS session. Header fields and sequence numbers provide metadata but not the payload itself, and DNS logs only show name resolution. Therefore, the reassembled stream is the only artifact that directly yields the transmitted data for forensic analysis.

Answer

The TCP sequence and acknowledgment numbers

Answer

The DNS query log associated with the session

Answer

The IP header total length field of each packet

Question 2

A forensic analyst is investigating a security incident in a Microsoft Azure environment. The organization suspects that an attacker used compromised credentials to access an Azure virtual machine and exfiltrate data. The analyst needs to collect evidence from Azure that can show authentication events and network traffic related to the VM. Which TWO Azure sources should the analyst prioritize for this investigation? (Choose two.)

Accepted Answer

Network Watcher flow logs. The Azure Activity Log captures control plane operations and authentication events, which can reveal suspicious management actions or sign-ins. Network Watcher flow logs provide network traffic metadata that can show exfiltration attempts from the VM. Together, they offer both the identity and network perspective needed for the investigation. The other sources are not security logs and lack the necessary event detail.

Answer

Azure Advisor recommendations

Answer

Azure Service Health notifications

Answer

Azure Cost Management exports

Question 3

A forensic investigator is examining a PCAP file collected from a network tap. The investigator notices a large number of TCP SYN packets sent to various ports on a single target IP address, with no corresponding SYN-ACK responses. Which type of activity does this pattern MOST likely indicate?

Accepted Answer

TCP SYN flood attack. The large volume of TCP SYN packets without SYN-ACK responses is characteristic of a SYN flood, where an attacker attempts to exhaust the target's connection resources. Port scanning would typically receive some responses, and UDP or ARP attacks involve different protocols. Thus, the pattern most likely indicates a SYN flood attack.

Answer

UDP fragmentation attack

Answer

ARP spoofing

Answer

TCP port scanning

Question 4

An investigator needs to capture network traffic from a live network segment without altering the traffic flow. Which technique should they use?

Accepted Answer

Configure a SPAN port on the switch. A SPAN (Switched Port Analyzer) port, also known as a mirror port, copies all traffic from a specified source port or VLAN to a destination port where the forensic workstation is connected. This allows the investigator to capture traffic without injecting any frames or altering the forwarding behavior of the switch, thus preserving the integrity of the live network segment.

Answer

Enable NetFlow on the router and capture flows

Answer

Deploy an ARP spoofing tool to redirect traffic

Answer

Set the NIC to promiscuous mode on the forensic workstation

Question 5

During a cloud forensics investigation, the investigator discovers that the cloud provider uses shared storage for multiple tenants. Which challenge is MOST likely to arise when acquiring a forensic image?

Accepted Answer

Data commingling with other tenants. In cloud environments with shared storage, data from multiple tenants resides on the same physical or logical volume. When acquiring a forensic image, the investigator cannot isolate a single tenant's data without also capturing other tenants' data, leading to data commingling. This violates chain-of-custody and privacy principles, making it the primary challenge.

Answer

Physical acquisition of the storage device is required

Answer

No API access to the storage system

Answer

Inability to decrypt data at rest

Question 6

A security team needs to preserve network evidence for a potential legal case. What is the BEST practice for capturing volatile network data?

Accepted Answer

Perform packet capture using a portable tool and store the capture with a cryptographic hash. Capturing volatile network data requires immediate acquisition of live traffic before it is lost, and using a portable tool (e.g., tcpdump, Wireshark) allows rapid deployment. Storing the capture with a cryptographic hash (e.g., SHA-256) ensures data integrity and chain of custody, which is essential for admissibility in legal proceedings. This approach preserves the most volatile evidence (packet contents) while providing verifiable proof that the data has not been altered.

Answer

Wait until normal business hours to capture traffic

Answer

Only record summary logs from the firewall

Answer

Use a dedicated forensic workstation with a write blocker

Question 7

In a cloud forensic investigation, the analyst needs to obtain a memory dump of a virtual machine. Which method is considered forensically sound?

Accepted Answer

Take a snapshot of the VM via the hypervisor and export the .vmem file. Forensically sound because taking a snapshot of the VM via the hypervisor and exporting the .vmem file captures the entire volatile memory state from outside the guest OS, without altering any data inside the VM. This method preserves the memory in its pristine state and avoids the contamination that occurs when executing tools inside the suspect VM.

Answer

Log into the VM and use a tool to create a crash dump

Answer

Copy the virtual disk file (.vmdk) and extract memory from it

Answer

Use a live forensic tool inside the VM to capture memory

Question 8

During a network forensic investigation, the analyst recovers a PCAP file. What type of information can be directly extracted from this file?

Accepted Answer

Files transferred via HTTP. A PCAP file captures raw network packets. HTTP is an application-layer protocol that transmits data (e.g., files, web pages) in cleartext over TCP. By reassembling TCP streams from the captured packets, an analyst can directly extract files transferred via HTTP, as the payload contains the actual file content.

Answer

Operating system version of the source host

Answer

Registry data of the destination host

Answer

Disk partition table of the sending computer

Question 9

An investigator is analyzing cloud storage logs and finds an entry showing that a file was accessed using the root credentials from an IP address in a different geographic region. The organization has strict policies against root usage. What should the investigator do FIRST?

Accepted Answer

Check if the activity correlates with a known vulnerability or authorized task. The first step in any forensic investigation is to correlate the suspicious activity with known events, such as authorized tasks or vulnerabilities, to avoid false positives. Root access from an unfamiliar IP could be legitimate if tied to a scheduled maintenance window or a known vulnerability exploitation attempt that requires verification. Prematurely changing credentials or contacting law enforcement could destroy evidence or alert an attacker before the scope is understood.

Answer

Contact law enforcement for cybercrime investigation

Answer

Change the password of the root account

Answer

Immediately revoke the root access keys

Question 10

A forensic analyst is examining a network intrusion detection system (NIDS) alert that triggered on a packet with the FIN, PSH, and URG flags set. What type of scan does this indicate?

Accepted Answer

Xmas scan. A is correct because an Xmas scan sends packets with the FIN, PSH, and URG flags set (like a Christmas tree lit up). According to RFC 793, a closed port must respond with an RST packet, while an open port should drop the packet silently (no response). The NIDS alert triggered on these three flags together, which is the signature of an Xmas scan.

Answer

NULL scan

Answer

SYN scan

Answer

ACK scan

Question 11

Based on the ARP table exhibit, what is the most likely security issue?

Accepted Answer

ARP poisoning attack. The ARP table exhibit shows a single IP address (192.168.1.1) mapped to two different MAC addresses (00:11:22:33:44:55 and AA:BB:CC:DD:EE:FF). This is a classic indicator of an ARP poisoning attack, where an attacker sends forged ARP replies to associate their MAC address with the gateway's IP, enabling man-in-the-middle interception of traffic.

Answer

The gateway is unreachable

Answer

Duplicate IP addresses on the network

Answer

MAC address filtering is enabled

Question 12

Based on the log exhibit, what type of attack is occurring?

Accepted Answer

Brute-force attack on SSH. The log shows multiple failed SSH login attempts from the same IP address with different usernames and passwords, which is characteristic of a brute-force attack targeting SSH. The repeated 'Failed password' entries for various user accounts (e.g., root, admin, user) indicate an automated attempt to guess credentials, not a single successful compromise or a different attack type.

Answer

Man-in-the-middle attack

Answer

SQL injection attack

Answer

Denial of Service attack

Question 13

You are investigating a network breach at a financial institution. The organization uses a network-based intrusion detection system (NIDS) and maintains full packet capture (PCAP) for critical segments. The incident allegedly started with a spear-phishing email that delivered a remote access trojan (RAT). The security team has isolated the infected host and provided you with a disk image of the host and a PCAP file covering the network traffic from the host for the 24-hour period before isolation. In the PCAP, you see a series of TCP connections from the host to an external IP address on port 443 (HTTPS). The external IP is known to be associated with a command-and-control (C2) server. However, the disk image shows no evidence of the RAT binary or any malicious files. The host's antivirus logs are clean. Which of the following is the most likely explanation for the lack of evidence on the disk?

Accepted Answer

The malware was fileless and only resided in memory. The absence of the RAT binary and any malicious files on the disk, combined with clean antivirus logs and active C2 traffic over HTTPS, strongly indicates a fileless malware infection. Fileless malware operates entirely in memory (RAM), never writing its payload to disk, which explains why the disk image shows no artifacts and why traditional file-scanning antivirus did not detect it. The TCP connections to the C2 server on port 443 are consistent with a memory-resident RAT that loads directly into a legitimate process (e.g., PowerShell, WMI, or a script interpreter) and communicates over encrypted HTTPS to evade network inspection.

Answer

The antivirus software deleted the malicious files before the image was taken

Answer

The hard drive was reimaged before the forensic image was taken

Answer

The RAT uses a rootkit to hide its files

Question 14

During a forensic investigation, the analyst runs netstat -ano on a compromised workstation. Based on the exhibit, which connection is MOST suspicious and should be investigated further?

Accepted Answer

The established HTTPS connection to 203.0.113.5:443 (PID 5678).. The established HTTPS connection to 203.0.113.5:443 (PID 5678) is most suspicious because it is an external IP address (not in the private RFC 1918 range) with an established TCP connection, indicating active data transfer. In a forensic context, an outbound HTTPS connection to an unknown external IP is a common indicator of command-and-control (C2) communication or data exfiltration, especially when the PID can be traced to an unknown or malicious process.

Answer

The DNS query to 192.168.1.1:53 in TIME_WAIT state.

Answer

The UDP listener on port 5353 (mDNS) with PID 910.

Answer

The listening RDP service on port 3389 (PID 1234).

Question 15

You are a forensic investigator responding to a data breach at a mid-sized company. The company uses a hybrid cloud environment with AWS for production workloads and on-premises servers for legacy applications. The breach was detected when an internal monitoring system flagged unusual outbound traffic from an AWS EC2 instance (i-0a1b2c3d4e5f) to an external IP address (198.51.100.20) on TCP port 4444 during off-hours. The EC2 instance runs a Linux-based web server. The security team has already isolated the instance by removing its security group rules and stopping the instance. You have been provided with the following: (1) AWS CloudTrail logs for the past 72 hours, (2) VPC Flow Logs for the same period, (3) a snapshot of the instance’s root volume (EBS), and (4) the instance metadata log from the AWS console. The company’s incident response policy requires preservation of all volatile data before powering off the instance. Which of the following steps should you take FIRST to ensure a forensically sound investigation?

Accepted Answer

Create a forensic copy of the EBS snapshot and attach it to a separate analysis EC2 instance in a different AWS account to avoid altering evidence.. The first step in a forensically sound investigation is to create a forensic copy (bit-for-bit) of the EBS snapshot before any analysis. This preserves the original evidence integrity, as required by the order of volatility and chain of custody. Attaching the copy to a separate analysis EC2 instance in a different AWS account prevents accidental modification of the original snapshot and isolates the forensic environment from the compromised production account.

Answer

Acquire a memory dump from the stopped instance by re-attaching the root volume to a forensic workstation.

Answer

Review the instance metadata log to identify the user who launched the instance.

Answer

Analyze the VPC Flow Logs to determine if other instances communicated with the same external IP.