CHFI Timed Practice Test 3 — 10 Questions

Question 1

During a network forensic investigation, you need to capture live network traffic from a switch span port. Which tool would best capture the traffic in a forensically sound manner?

Accepted Answer

Wireshark. Wireshark is the best tool for capturing live network traffic from a switch SPAN port in a forensically sound manner because it provides a robust graphical interface for real-time packet capture and analysis, supports full packet capture with timestamps, and can write captures directly to a pcapng file format that preserves packet integrity and metadata. Its ability to run in promiscuous mode ensures all traffic from the SPAN port is captured without altering the data, meeting forensic requirements for accuracy and completeness.

Answer

Nmap

Answer

Netcat

Answer

Tcpdump

Question 2

The command used to acquire a disk image resulted in an I/O error. What is the most likely cause?

Accepted Answer

The source disk has bad sectors. When a disk imaging tool (e.g., dd, FTK Imager, EnCase) encounters an I/O error during acquisition, the most common cause is physical damage or degradation of the source media, specifically bad sectors. Bad sectors prevent the read head from reliably retrieving data, triggering an I/O error at the operating system or device driver level. This is distinct from logical errors like file system corruption, which typically produce different error messages.

Answer

The output file already exists and is being overwritten

Answer

The target directory does not have write permissions

Answer

The target drive is full

Question 3

An organization uses a cloud-based SIEM to collect logs from multiple sources. The investigator notices gaps in the log data for a critical system during the incident timeframe. What is the MOST likely cause?

Accepted Answer

Time drift between the system and the SIEM. Time drift between the system and the SIEM causes logs to be timestamped incorrectly, leading to apparent gaps when the SIEM queries by time range. Even if logs are delivered, they may fall outside the incident timeframe in the SIEM's index, creating the illusion of missing data. This is a common issue in cloud-based SIEMs where NTP synchronization is not enforced across all sources.

Answer

Network latency delayed log delivery

Answer

Log rotation policy deleted logs prematurely

Answer

The system's log level was set to ERROR only

Question 4

A forensic analyst is investigating a network breach and finds that the attacker used a technique that bypasses Network Access Control (NAC). Which of the following methods is commonly used to evade 802.1X authentication?

Accepted Answer

MAC address spoofing. MAC address spoofing is commonly used to bypass 802.1X authentication because 802.1X typically authenticates devices based on their MAC address after the EAP (Extensible Authentication Protocol) handshake. By spoofing the MAC address of an already-authenticated device, the attacker can impersonate that device and gain network access without valid credentials, effectively bypassing the NAC enforcement.

Answer

VLAN hopping using double tagging

Answer

DNS tunneling to exfiltrate data

Answer

ARP poisoning to redirect traffic

Question 5

An investigator is analyzing cloud storage logs and finds an entry showing that a file was accessed using the root credentials from an IP address in a different geographic region. The organization has strict policies against root usage. What should the investigator do FIRST?

Accepted Answer

Check if the activity correlates with a known vulnerability or authorized task. Option A is correct because the first step in any forensic investigation is to correlate the suspicious activity with known events, such as authorized tasks or vulnerabilities, to avoid false positives. Root access from an unfamiliar IP could be legitimate if tied to a scheduled maintenance window or a known vulnerability exploitation attempt that requires verification. Prematurely changing credentials or contacting law enforcement could destroy evidence or alert an attacker before the scope is understood.

Answer

Contact law enforcement for cybercrime investigation

Answer

Change the password of the root account

Answer

Immediately revoke the root access keys

Question 6

An investigator finds the above IAM policy attached to an S3 bucket. What is the security concern?

Accepted Answer

The bucket is publicly accessible to read objects. Option C is correct because the IAM policy's `Principal` is set to `"*"` (wildcard), which means any unauthenticated user or anonymous entity on the internet can perform the `s3:GetObject` action. This makes the S3 bucket publicly readable, exposing all objects stored in the bucket to anyone who knows the bucket name and object key. The `Effect` is `Allow` and there is no condition restricting access, so the policy grants open read access to the entire bucket.

Answer

The resource does not include all objects

Answer

The policy version is outdated

Answer

The policy allows anyone to write objects to the bucket

Question 7

Based on the log exhibit, what type of attack is occurring?

Accepted Answer

Brute-force attack on SSH. The log shows multiple failed SSH login attempts from the same IP address with different usernames and passwords, which is characteristic of a brute-force attack targeting SSH. The repeated 'Failed password' entries for various user accounts (e.g., root, admin, user) indicate an automated attempt to guess credentials, not a single successful compromise or a different attack type.

Answer

Man-in-the-middle attack

Answer

SQL injection attack

Answer

Denial of Service attack

Question 8

An analyst receives an alert indicating a suspicious process (PID 3342) is making outbound connections on port 443 to an unknown IP. The system is a Windows 10 workstation. Which first responder action is MOST appropriate?

Accepted Answer

Capture a full memory dump using a tool like FTK Imager (Memory Capture) or DumpIt.. Capturing a full memory dump (option A) is the most appropriate first responder action because it preserves the volatile state of the suspicious process (PID 3342) and its associated artifacts (e.g., network connections, loaded DLLs, encryption keys) before any further system changes occur. This allows forensic analysis to identify the malware's behavior, such as command-and-control (C2) communication over port 443 (HTTPS), without altering evidence. Tools like FTK Imager (Memory Capture) or DumpIt acquire a raw .mem file that can be analyzed with Volatility or Rekall to extract process details, network sockets, and injected code.

Answer

Immediately disconnect the system from the network to contain the threat.

Answer

Check the Windows Event Logs for related entries.

Answer

Reboot the system to clear any malicious processes from memory.

Question 9

During a forensic investigation, you are asked to acquire the contents of RAM from a live Windows 10 system without causing system instability. Which tool would be most appropriate for this task?

Accepted Answer

Belkasoft RAM Capturer. Belkasoft RAM Capturer is the most appropriate tool for acquiring RAM from a live Windows 10 system because it is designed specifically for live memory acquisition on Windows, uses a lightweight kernel-mode driver to read physical memory without causing system instability, and supports acquisition from 64-bit systems. Unlike other tools, it minimizes interaction with the target process list and avoids loading unnecessary user-mode components that could trigger crashes or alter the memory state.

Answer

LiME

Answer

DumpIt

Answer

FTK Imager

Question 10

You are acquiring a laptop with a self-encrypting drive (SED) that is powered on and logged in. What is the best method to acquire the drive while preserving encrypted data?

Accepted Answer

Acquire a logical image from the running operating system. When a self-encrypting drive (SED) is powered on and logged in, the drive's hardware encryption key is already loaded and the data is accessible through the operating system. The best method to preserve the encrypted data in its decrypted state is to acquire a logical image from the running OS, which captures files and metadata without powering off the drive and losing the decryption context. Removing power or rebooting would cause the SED to lock, requiring the authentication key again and potentially altering the data state.

Answer

Remove the drive and use a forensic bridge that supports SED

Answer

Power off the laptop and image the drive using a hardware write blocker

Answer

Boot from a forensic live CD and image the drive