CHFI Timed Practice Test 5 — 10 Questions

Question 1

A forensic analyst is examining a PostgreSQL database server that was compromised. The attacker gained superuser access and deleted several rows from a critical table. The database is configured with WAL (Write-Ahead Log) archiving. Which method would allow the analyst to identify the exact time the deletions occurred?

Accepted Answer

Use the pg_waldump utility to parse the WAL files and identify DELETE operations with timestamps.. D is correct because `pg_waldump` is the PostgreSQL utility specifically designed to parse Write-Ahead Log (WAL) files and display their contents in a human-readable format, including the exact timestamps and operation types (e.g., DELETE). Since the database uses WAL archiving, the archived WAL segments will contain a record of every data modification, allowing the analyst to pinpoint when the deletions occurred.

Answer

Review the pg_stat_activity view to see the history of queries executed.

Answer

Examine the archive_status directory to find the timestamp of the WAL file that contains the deletion.

Answer

Query the pg_audit table to retrieve a log of all DELETE statements.

Question 2

During a malware investigation, an analyst discovers a suspicious file with a hash value that matches known malware. However, the file fails to execute and does not exhibit any malicious behavior in a sandbox. What is the most likely reason for this discrepancy?

Accepted Answer

The file is packed or obfuscated to prevent execution in a sandbox. Option D is correct because malware authors often use packing or obfuscation techniques to prevent the malicious payload from executing in an analysis environment. The packed code requires a specific unpacking routine or trigger (e.g., a specific system call, registry key, or timing condition) that the sandbox does not provide, causing the file to appear inert. This is a common anti-sandbox technique distinct from simple signature evasion.

Answer

The file is a false positive and is actually benign

Answer

The sandbox is not updated with the latest signatures

Answer

The file's metadata has been modified to evade analysis

Question 3

Which THREE of the following are best practices for conducting malware forensics in a safe and effective manner?

Accepted Answer

Use a dedicated forensic workstation that is not connected to any network. Option A is correct because a dedicated forensic workstation that is not connected to any network prevents the malware from communicating with command-and-control (C2) servers, exfiltrating data, or spreading to other systems. This isolation ensures the integrity of the analysis environment and protects the broader infrastructure from accidental infection or data leakage.

Answer

Delete the malware sample after analysis to prevent accidental infection

Answer

Run all analysis using the same tools and versions as the attacker

Question 4

An organization suspects a stealthy malware infection on a critical server. Traditional antivirus and EDR solutions have not detected anything. Which forensic approach would be most effective in identifying the malware, given that it likely resides only in memory?

Accepted Answer

Acquire a memory dump and perform memory forensics with tools like Volatility. Option B is correct because the malware resides only in memory, making it invisible to disk-based scans. Memory forensics with tools like Volatility allows investigators to analyze RAM artifacts (e.g., processes, network connections, injected code) to detect stealthy malware that never writes to disk.

Answer

Perform a full disk scan with updated antivirus signatures

Answer

Conduct a live analysis using built-in Windows tools like Task Manager

Answer

Analyze network traffic for anomalies using a NetFlow analyzer

Question 5

Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?

Accepted Answer

It is a virtual directory that contains files with no parent directory, often from deleted files. In The Sleuth Kit (TSK), the 'fls' command lists files and directories within a disk image. The entry 'V/V 113-128-1: $OrphanFiles' is a virtual directory that contains files that have no parent directory in the file system, typically because their directory entries were deleted or corrupted. This is a common artifact when recovering deleted files from NTFS volumes, as TSK collects such orphaned MFT entries into this virtual container.

Answer

It is a sign that a rootkit has hidden files in the image

Answer

It indicates the location of the Master File Table (MFT) mirror

Answer

It is a standard NTFS metadata file that stores file permissions

Question 6

A security analyst is tasked with reverse engineering a suspected malware sample. Which initial step should the analyst take to ensure safe handling and prevent accidental infection?

Accepted Answer

Create a bit-for-bit forensic image of the sample. Creating a bit-for-bit forensic image (option A) is the correct first step because it preserves the malware in an immutable, write-protected state, preventing any accidental execution or modification. This ensures the integrity of the evidence and allows the analyst to work with a safe copy without risking infection of the host system or network. In malware forensics, this aligns with the fundamental principle of maintaining a chain of custody and avoiding alteration of the original sample.

Answer

Execute the sample in a debugger on a production machine

Answer

Disassemble the binary using IDA Pro directly

Answer

Connect the sample to an isolated network to observe behavior

Question 7

During malware analysis, an investigator finds that a suspicious process is injecting code into a legitimate system process (e.g., explorer.exe). Which technique is being used?

Accepted Answer

Code injection. Code injection is the correct answer because the scenario describes a process injecting arbitrary code into a legitimate system process like explorer.exe. This is the generic term for techniques where malicious code is written into the address space of another process and executed, often via Windows API calls such as WriteProcessMemory and CreateRemoteThread. The question explicitly states 'injecting code,' which directly maps to the broad category of code injection, not a specific subtype.

Answer

API hooking

Answer

Process hollowing

Answer

DLL injection

Question 8

Which TWO of the following are common indicators of a rootkit infection on a Windows system?

Accepted Answer

System calls returning inconsistent results. Option B is correct because rootkits operate at the kernel level, intercepting system calls to hide their presence. When a system call (e.g., NtQuerySystemInformation) is invoked, the rootkit modifies the return data to exclude malicious processes or files, causing the results to be inconsistent with the actual system state. This is a classic symptom of a kernel-mode rootkit that has hooked the System Service Dispatch Table (SSDT).

Answer

High CPU usage by svchost.exe

Answer

Unexpected open ports on the firewall

Answer

Presence of unsigned kernel drivers

Question 9

Drag and drop the steps to perform a forensic examination of a mobile device (Android) using Cellebrite UFED into the correct order.

Question 10

Drag and drop the steps to conduct a memory acquisition using DumpIt on a Windows system into the correct order.