CHFI Timed Practice Test 1 — 10 Questions

Question 1

Which TWO of the following are valid reasons for using a hardware write blocker during disk acquisition? (Choose two.)

Accepted Answer

It allows the source drive to be connected to a forensic workstation without risking modification. A hardware write blocker is a device that sits between the source drive and the forensic workstation, intercepting and blocking any write commands from the host operating system. This ensures that the source drive is connected in a read-only state, preventing any accidental modifications to the evidence during acquisition. Option C correctly identifies this core function of preserving the integrity of the source drive.

Answer

It compresses the acquired data to save storage space

Answer

It increases the speed of data acquisition

Answer

It creates a forensic image of the drive

Question 2

During a forensic investigation, an analyst needs to acquire the contents of a live server's RAM without altering the evidence. Which tool and technique should the analyst use to minimize the footprint on the system?

Accepted Answer

Run a trusted version of win32dd.exe from a write-protected USB drive and capture memory to the USB. Option B is correct because running a trusted version of win32dd.exe (now commonly part of the Belkasoft or DumpIt suite) from a write-protected USB drive ensures the tool binary is not modified by the compromised system and does not write any artifacts to the server's disk. Capturing memory directly to the USB drive minimizes the forensic footprint by avoiding writes to the server's local storage, preserving the integrity of the evidence.

Answer

Install FTK Imager on the server and capture memory to a network share

Answer

Use a remote acquisition tool over SSH to capture memory to a remote server

Answer

Use the built-in task manager to create a memory dump and save it locally

Question 3

You are a forensic investigator responding to a data breach at a mid-sized company. The company uses a hybrid cloud environment with AWS for production workloads and on-premises servers for legacy applications. The breach was detected when an internal monitoring system flagged unusual outbound traffic from an AWS EC2 instance (i-0a1b2c3d4e5f) to an external IP address (198.51.100.20) on TCP port 4444 during off-hours. The EC2 instance runs a Linux-based web server. The security team has already isolated the instance by removing its security group rules and stopping the instance. You have been provided with the following: (1) AWS CloudTrail logs for the past 72 hours, (2) VPC Flow Logs for the same period, (3) a snapshot of the instance’s root volume (EBS), and (4) the instance metadata log from the AWS console. The company’s incident response policy requires preservation of all volatile data before powering off the instance. Which of the following steps should you take FIRST to ensure a forensically sound investigation?

Accepted Answer

Create a forensic copy of the EBS snapshot and attach it to a separate analysis EC2 instance in a different AWS account to avoid altering evidence.. Option C is correct because the first step in a forensically sound investigation is to create a forensic copy (bit-for-bit) of the EBS snapshot before any analysis. This preserves the original evidence integrity, as required by the order of volatility and chain of custody. Attaching the copy to a separate analysis EC2 instance in a different AWS account prevents accidental modification of the original snapshot and isolates the forensic environment from the compromised production account.

Answer

Acquire a memory dump from the stopped instance by re-attaching the root volume to a forensic workstation.

Answer

Review the instance metadata log to identify the user who launched the instance.

Answer

Analyze the VPC Flow Logs to determine if other instances communicated with the same external IP.

Question 4

Which TWO of the following are valid techniques for collecting volatile network evidence from a live system during incident response?

Accepted Answer

Running netstat -an to view active TCP/UDP connections.. Option D is correct because `netstat -an` displays all active TCP and UDP connections along with their listening ports and states, which is critical for identifying unauthorized or malicious network connections on a live system. This command provides a snapshot of current network sessions without altering system state, making it a standard volatile evidence collection technique.

Answer

Using route print to view the IP routing table.

Answer

Using ipconfig /displaydns to view the DNS resolver cache.

Answer

Running arp -a to view the ARP table.

Question 5

A first responder is responding to a ransomware incident on a Windows server. Which TWO actions should be performed to preserve evidence? (Choose two.)

Accepted Answer

Power off the server to prevent further data encryption.. Option B is correct because powering off the server preserves the encrypted state of the disk and prevents the ransomware from continuing to encrypt additional files or communicate with its command-and-control server. In a ransomware incident, immediate shutdown halts the encryption process and preserves the volatile evidence on disk, such as the ransomware binary and encrypted files, for forensic analysis.

Answer

Run an antivirus scan to remove the ransomware.

Answer

Restore the system from backup to minimize downtime.

Answer

Disconnect the network cable immediately.

Question 6

Refer to the exhibit. A first responder runs the netstat command on a compromised Windows workstation. Which of the following conclusions is BEST supported by the output?

Accepted Answer

A process with PID 1234 is likely communicating with a remote C2 server at 10.2.3.4.. Option C is correct because an established TCP connection (ESTABLISHED state) from the workstation to a remote IP on a high ephemeral port (49152) with PID 1234 strongly indicates active communication. This is a classic indicator of a beaconing C2 channel, as legitimate outbound connections typically use well-known ports or are short-lived. The netstat output shows PID 1234 has a persistent connection to 10.2.3.4:4444, which is a common port for malware command and control.

Answer

The connection to 192.168.1.1:80 is suspicious because it is in TIME_WAIT state.

Answer

The UDP listener on port 5353 indicates a malware infection.

Answer

The workstation is running multiple virtual machines based on the local addresses.

Question 7

Refer to the exhibit. The FTK Imager output shows a disk with an NTFS partition. The examiner notes that the $MFT mirror is at cluster 2. What is the logical size of the $MFT mirror in bytes?

Accepted Answer

4096 bytes. The $MFT mirror is a backup copy of the first four records of the Master File Table. Each MFT record is 1024 bytes, so four records total 4096 bytes. The FTK Imager output confirms the cluster size is 4096 bytes, and since the $MFT mirror occupies exactly one cluster (cluster 2), its logical size is 4096 bytes.

Answer

320 GB

Answer

512 bytes

Answer

8192 bytes

Question 8

Refer to the exhibit. During a malware investigation, a forensic analyst runs the commands shown. What is the most likely conclusion?

Accepted Answer

Rundll32.exe with PID 1500 is likely a backdoor listening on port 4444.. Option D is correct because the netstat output shows a listening connection on port 4444 associated with PID 1500, which the tasklist command identifies as rundll32.exe. Port 4444 is a common backdoor port (often used by Metasploit or other RATs), and rundll32.exe is a legitimate Windows binary frequently abused by malware to host malicious code (e.g., via DLL sideloading or reflective injection). The combination of an unusual listening port and a process that is not a typical network service (like svchost.exe) strongly indicates a backdoor.

Answer

Svchost.exe processes are hosting legitimate Windows services; no malware is present.

Answer

The malware has injected code into svchost.exe using a reflective DLL injection tool.

Answer

The malware is using port 4444 for Windows Update communications.

Question 9

A forensic investigator is analyzing a Microsoft SQL Server instance that was compromised. The investigator wants to identify all login attempts that failed due to incorrect passwords. Which system function or view should be queried?

Accepted Answer

xp_readerrorlog with filter for 'Login failed'. The xp_readerrorlog extended stored procedure reads the SQL Server error log, which records all login attempts, including failures. By filtering for 'Login failed', the investigator can retrieve the exact entries where authentication failed due to incorrect passwords. This is the standard method for auditing failed logins in SQL Server.

Answer

sys.dm_exec_sessions

Answer

sys.dm_tran_locks

Answer

sys.dm_exec_requests

Question 10

Which THREE of the following are indicators of malware persistence via registry run keys? (Choose three.)

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce is a registry run key that executes programs once at user logon and then deletes the entry. Malware often uses this key to run a payload a single time, such as during initial infection or after a reboot, to establish persistence without leaving a continuous trace in the Run key.

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services