Courseiva

CCNA OS and Network Forensics Questions

32 questions · OS and Network Forensics · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selecteasy

Which TWO of the following are tools that can be used for timeline analysis in digital forensics?

Select 2 answers
A.Wireshark
B.Nmap
C.log2timeline
D.FTK Imager
E.Plaso
AnswersC, E

log2timeline is a tool for extracting timeline data from various sources.

Why this answer

log2timeline (option C) is a tool specifically designed for timeline analysis in digital forensics. It parses various log files and artifacts to create a super timeline, which is a comprehensive chronological record of system activity. This allows investigators to correlate events across multiple sources, such as file system timestamps, registry keys, and application logs.

Exam trap

EC-Council often tests the distinction between tools used for network analysis (Wireshark, Nmap) versus tools used for host-based timeline analysis (log2timeline, Plaso), leading candidates to confuse packet capture utilities with forensic timeline generators.

Practice this question →
2
MCQmedium

During a forensic investigation of a compromised Linux server, an analyst checks /var/log/auth.log and finds multiple entries like "Failed password for root from 10.0.0.5 port 22 ssh2". Which tool is BEST suited to analyze the timeline of these events?

A.Nmap
B.Wireshark
C.log2timeline
D.Autopsy
AnswerC

log2timeline is the standard tool for creating super timelines from log files.

Why this answer

C is correct because log2timeline (part of the Plaso framework) is specifically designed to parse multiple log sources, including /var/log/auth.log, and create a super timeline that correlates events by timestamp. This allows the analyst to reconstruct the exact sequence of failed SSH login attempts from 10.0.0.5, which is essential for timeline analysis in forensic investigations.

Exam trap

The EC-Council CHFI exam often tests the distinction between network analysis tools (Nmap, Wireshark) and forensic timeline tools (log2timeline), trapping candidates who confuse packet-level analysis with log-based event correlation.

How to eliminate wrong answers

Option A is wrong because Nmap is a network scanning tool used to discover hosts and services, not to analyze log file timestamps or event timelines. Option B is wrong because Wireshark is a packet capture and analysis tool that inspects live or recorded network traffic, not static log files like /var/log/auth.log. Option D is wrong because Autopsy is a digital forensics platform for disk image analysis and file system forensics, but it lacks native capability to parse and correlate syslog/auth.log entries into a unified timeline without additional plugins or manual import.

Practice this question →
3
MCQhard

During a forensic investigation, you find a prefetch file created at 03:15:22 UTC on the system. The corresponding executable's last modified timestamp is 02:30:00 UTC, and the system date/time shows a discrepancy of +5 minutes. What is the MOST accurate interpretation regarding the file execution time?

A.The program was executed at 02:30:00 UTC.
B.The program was executed at 03:15:22 UTC.
C.Execution time cannot be determined from prefetch files alone.
D.The program was executed at 03:10:22 UTC after adjusting for clock skew.
AnswerD

The prefetch file was created at system time 03:15:22, but the system clock is +5 minutes fast, so the actual UTC time is 03:10:22. This option correctly adjusts for clock skew and is the most accurate interpretation.

Why this answer

The prefetch file creation timestamp records the system time at execution. The system clock is +5 minutes ahead, so actual UTC at execution is 03:10:22 (03:15:22 minus 5 minutes). Option D correctly adjusts for this clock skew.

Option B is wrong because it ignores the clock discrepancy, which is a known issue in forensic analysis.

Exam trap

The CHFI exam often tests the misconception that the executable's last modified timestamp or the prefetch file's internal 'last run time' is the primary indicator of execution time, when in fact the prefetch file's creation timestamp is the key for first execution.

How to eliminate wrong answers

Option A is wrong because the executable's last modified timestamp indicates when the file was last changed on disk, not when it was executed; execution time is derived from the prefetch file's creation timestamp, not the executable's metadata. Option C is wrong because prefetch files do provide a reliable indicator of first execution time via their creation timestamp, though subsequent executions update the 'last run time' within the file. Option D is wrong because adjusting for clock skew would require subtracting the +5-minute discrepancy from the prefetch timestamp (03:15:22 - 0:05 = 03:10:22) only if the prefetch timestamp were in true UTC, but the prefetch timestamp is recorded in system local time (which already includes the +5-minute offset), so no adjustment is needed; the system's reported UTC is already skewed.

Practice this question →
4
Multi-Selecthard

Which FOUR of the following are persistence mechanisms that can be used on Linux systems?

Select 4 answers
A.Prefetch files
B.SSH authorized keys
C.Startup scripts in /etc/init.d
D.Cron jobs
E.Modifications to /etc/passwd to add new users
AnswersB, C, D, E

SSH authorized keys are a persistence mechanism because they enable an attacker to retain remote access without needing to re-exploit the system each time; by placing a public key in a user's ~/.ssh/authorized_keys file, the attacker can authenticate over SSH indefinitely, even if the user's password is changed. While they do not autonomously execute commands like cron or init scripts, the ongoing availability of a credentialed login channel is a recognized persistence technique in intrusion activity and should be examined in a forensic investigation.

Why this answer

Persistence mechanisms on Linux include SSH authorized keys (B), which allow an attacker to maintain remote access by adding their public key to the target user's authorized_keys file; startup scripts in /etc/init.d (C), which execute at boot; cron jobs (D), which run scheduled tasks; and modifications to /etc/passwd (E) to create persistent user accounts. Prefetch files (A) are Windows-specific and not a Linux persistence mechanism.

Exam trap

The trap is selecting Prefetch files (A), which are often associated with persistence on Windows but do not apply to Linux. All other options are valid Linux persistence mechanisms.

Practice this question →
5
MCQhard

A forensic examiner recovers a Windows 10 system and finds a prefetch file for powershell.exe with a last run time of 3 days ago, but the system's security logs show no interactive logons from that user. What does this discrepancy suggest?

A.PowerShell was executed as part of a scheduled task or service
B.The prefetch file is corrupted
C.The user deleted their profile
D.The system clock was changed
AnswerA

PowerShell launched via a scheduled task or service executes under logon type 4 (batch) or 5 (service), not interactive logon type 2. Consequently, the Security log will not contain a corresponding 4624 interactive logon event, even though prefetch records the powershell.exe execution with a valid last run time. This exactly matches the observed discrepancy, making non-interactive execution the correct forensic explanation.

Why this answer

A is correct because PowerShell.exe can be executed by non-interactive processes such as scheduled tasks or services, which do not generate interactive logon events (Event ID 4624) in the Security log. The prefetch file records the last run time regardless of the execution context, so a discrepancy between the prefetch timestamp and the absence of interactive logons indicates that PowerShell was launched by a system-level or automated mechanism, not by a user logging on interactively.

Exam trap

EC-Council often tests the misconception that prefetch files only record user-initiated executions, leading candidates to assume the timestamp must be wrong or that the user must have logged on, when in fact prefetch captures all executions including those from system services and scheduled tasks.

How to eliminate wrong answers

Option B is wrong because prefetch files are not typically corrupted in a way that would produce a plausible last run time without any corresponding logon activity; corruption would more likely result in unreadable timestamps or missing entries. Option C is wrong because deleting a user profile does not remove prefetch entries or alter the last run time recorded for an executable; the prefetch file would still reflect the last execution before deletion. Option D is wrong because changing the system clock would affect all timestamps uniformly, including both the prefetch file and security logs, so it would not create a discrepancy between the two; the discrepancy would only occur if the clock change was applied between the execution and the log generation, which is not a typical forensic scenario.

Practice this question →
6
Multi-Selecthard

Which THREE of the following are indicators of a webshell compromise on a web server?

Select 3 answers
A.High CPU usage from web server processes
B.Regular successful logins to the server with correct credentials
C.Presence of files with extensions like .php, .asp, or .jsp in web directories that are not part of the original application
D.Unexpected outbound connections from the web server to unknown IP addresses
E.Decrease in network traffic
AnswersA, C, D

Execution of arbitrary commands or scripts can spike CPU usage.

Why this answer

A webshell often executes malicious commands via the web server's process (e.g., Apache's httpd or IIS's w3wp.exe). This causes sustained high CPU usage because the webshell may be running resource-intensive tasks like password cracking, data exfiltration, or cryptomining within the web server's process context, which is a strong indicator of compromise.

Exam trap

Candidates often mistake normal administrative behavior (Option B) for suspicious activity, but webshells bypass authentication entirely, making regular successful logins irrelevant as indicators.

Practice this question →
7
MCQmedium

Which tool is commonly used for timeline analysis in digital forensics, allowing examiners to parse and correlate timestamps from various artifacts?

A.log2timeline
B.Sleuth Kit
C.Nmap
D.Wireshark
AnswerA

log2timeline/Plaso is the forensic tool for creating timelines from multiple artifacts.

Why this answer

log2timeline (now part of the Plaso framework) is the de facto tool for timeline analysis in digital forensics. It parses a wide range of artifacts (e.g., $MFT, $UsnJrnl, Prefetch, Registry hives, event logs) and correlates their timestamps into a unified, super-timeline, enabling examiners to reconstruct system activity chronologically.

Exam trap

EC-Council CHFI often tests the distinction between file system analysis tools (Sleuth Kit) and timeline correlation tools (log2timeline), so candidates may mistakenly choose Sleuth Kit because it includes mactime, forgetting that log2timeline is the primary tool for building a super-timeline from multiple artifacts.

How to eliminate wrong answers

Option B (Sleuth Kit) is wrong because it is a collection of command-line tools for file system analysis (e.g., fls, icat, mmls) but does not perform timeline correlation or multi-artifact timestamp parsing. Option C (Nmap) is wrong because it is a network scanning tool used for port discovery and service enumeration, not for forensic timeline analysis. Option D (Wireshark) is wrong because it is a network protocol analyzer for capturing and inspecting packets, not a tool for parsing file system or registry timestamps.

Practice this question →
8
MCQeasy

In network forensics, an analyst captures traffic and sees a large number of ICMP echo requests from 10.0.0.1 to 10.0.0.2 with varying payload sizes. What is the most likely scenario?

A.Network reconnaissance (ping sweep)
B.A man-in-the-middle attack
C.A DoS attack using ICMP floods
D.A DNS amplification attack
AnswerC

A large volume of ICMP echo requests (ping) from a single source to a single destination, especially with varying payload sizes, is a classic signature of an ICMP flood DoS attack. The sheer volume of packets consumes the target's bandwidth and processing resources, and the varied payload sizes are often used to defeat filters that block only fixed-size pings. This pattern is distinct from reconnaissance or protocol-specific abuse because it intentionally overwhelms the victim with raw ICMP traffic.

Why this answer

The scenario describes a single source sending a large number of ICMP echo requests to a single destination with varying payload sizes. This is characteristic of an ICMP flood attack, a type of DoS attack where the attacker overwhelms the target with echo requests, consuming bandwidth and processing resources. The varying payload sizes may be an attempt to evade simple packet filters or to maximize resource consumption.

In contrast, a ping sweep would involve sending requests to multiple destinations to discover live hosts, not a sustained high-volume stream to one host. Therefore, this is most likely a DoS attack, not reconnaissance.

Exam trap

EC-Council often tests the ability to differentiate between reconnaissance and attack by presenting ICMP traffic with varying payloads. Candidates may mistakenly classify a high-volume single-target ICMP flood as a ping sweep (Option A) due to the payload variation, but the key indicator is the single destination and overwhelming volume, which points to a DoS attack.

How to eliminate wrong answers

Option B is wrong because a man-in-the-middle attack typically involves ARP spoofing, DNS spoofing, or session hijacking, not a series of ICMP echo requests with varying payloads. Option C is wrong because a DoS attack using ICMP floods would involve a high volume of packets from potentially multiple sources to overwhelm the target, not a single source sending packets with varying sizes to a single destination, which is too low-volume for denial of service. Option D is wrong because a DNS amplification attack uses spoofed DNS queries with a small request size to generate large responses from open resolvers, targeting a victim with UDP traffic, not ICMP echo requests.

Practice this question →
9
Multi-Selectmedium

A forensic analyst is investigating a Windows system for evidence of malware persistence. Which TWO registry locations are commonly used by malware to automatically execute on system startup?

Select 2 answers
A.HKLM\SAM
B.C:\Windows\Prefetch
C.HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellBags
D.HKLM\SYSTEM\CurrentControlSet\Services
E.HKCU\Software\Microsoft\Windows\CurrentVersion\Run
AnswersD, E

Services subkeys can be configured to start automatically, used by malware for persistence.

Why this answer

D is correct because the HKLM\SYSTEM\CurrentControlSet\Services registry key stores configuration for Windows services, including the ImagePath value that specifies the executable to run. Malware often installs as a service to achieve automatic execution at system startup, as services are started by the Service Control Manager (SCM) during boot, independent of user logon.

Exam trap

The trap here is that candidates confuse registry locations used for user-specific startup (like HKCU\...\Run) with system-wide persistence mechanisms, or they mistakenly think non-startup keys like SAM or ShellBags are relevant to auto-execution.

Practice this question →
10
MCQmedium

A network forensics analyst captures traffic and sees a series of TCP SYN packets sent to multiple ports on a target, with no corresponding SYN-ACK replies. What type of activity is MOST likely indicated?

A.A denial-of-service (DoS) flood
B.A port scan reconnaissance
C.A man-in-the-middle attack
D.Normal web browsing traffic
AnswerB

This pattern is the classic signature of a TCP SYN scan, a common port scanning technique. The attacker sends a SYN packet to each port on a target; if the port is open, the target responds with a SYN-ACK, while closed ports trigger an RST or no reply. Observing multiple SYN packets to different ports without complete handshakes indicates systematic probing to enumerate which services are listening, exactly what a port scan reconnaissance does.

Why this answer

The observation of TCP SYN packets sent to multiple ports without any SYN-ACK replies indicates a port scan, specifically a SYN scan (half-open scan). In a SYN scan, the attacker sends a SYN packet to each port; if the port is open, the target responds with a SYN-ACK, but the attacker never completes the handshake. The absence of any SYN-ACK replies suggests that either all scanned ports are closed (RST responses would be expected) or the target is filtering traffic, but the pattern of multiple SYN packets to different ports is the hallmark of reconnaissance, not a denial-of-service attack.

Exam trap

A common trap is confusing a SYN scan (reconnaissance) with a SYN flood (DoS attack); the key differentiator is the lack of SYN-ACK replies combined with scanning multiple ports, indicating reconnaissance rather than an attempt to overwhelm the target.

How to eliminate wrong answers

Option A is wrong because a denial-of-service (DoS) flood typically involves a high volume of traffic (e.g., SYN flood) to overwhelm a target, often with spoofed source IPs, and would generate SYN-ACK replies from the target if ports are open; the absence of SYN-ACK replies here suggests a scan, not an attack. Option C is wrong because a man-in-the-middle attack requires intercepting and potentially modifying communications between two parties, which is not indicated by a series of SYN packets to multiple ports with no replies. Option D is wrong because normal web browsing traffic involves completing the TCP three-way handshake (SYN, SYN-ACK, ACK) and then exchanging HTTP data, not sending SYN packets to multiple ports without receiving SYN-ACK replies.

Practice this question →
11
Multi-Selectmedium

Which TWO of the following are valid artifacts for determining program execution on a Windows system? (Select TWO.)

Select 2 answers
A.Pagefile.sys
B.System Restore points
C.Jump Lists
D.Prefetch files
E.Windows Error Reporting logs
AnswersC, D

Jump Lists record recently accessed files per application, showing usage.

Why this answer

Jump Lists (C) are correct because they store recently accessed files and applications per user, providing a timeline of program execution. Prefetch files (D) are correct because they contain execution counts, timestamps, and file paths for applications launched on Windows, directly indicating program execution.

Exam trap

EC-Council often tests the distinction between artifacts that record normal execution (Prefetch, Jump Lists) versus those that capture system state or errors (Pagefile, Restore Points, WER logs), leading candidates to overestimate the forensic value of Pagefile.sys or System Restore points.

Practice this question →
12
MCQmedium

A forensic analyst is investigating a Windows system for evidence of USB device usage. Which registry key is MOST useful for determining the first time a USB device was connected and its serial number?

A.HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
B.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
C.HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellBags
D.HKLM\SYSTEM\CurrentControlSet\Enum\USB
AnswerA

This is the authoritative artifact for USB mass storage device forensics. Each time a USB drive or external storage device is attached, Windows enumerates it under HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR, creating a subkey whose name contains the device instance ID, vendor, product, revision, and often the unique serial number. The LastWrite time of these subkeys reflects when the device was installed/configured, enabling an examiner to reconstruct a timeline of device connections and identify the specific physical drive by its serial number.

Why this answer

The USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum stores a subkey for each USB mass storage device that has ever been connected to the system. Each subkey is named with the device's serial number, and its creation timestamp reflects the first time the device was enumerated (i.e., first connected). This makes it the definitive source for both the serial number and the initial connection time of a USB device.

Exam trap

EC-Council often tests whether candidates confuse the generic USB hub enumeration key (USB) with the mass storage device-specific key (USBSTOR), leading them to pick Option D instead of A.

How to eliminate wrong answers

Option B is wrong because MountPoints2 stores user-specific drive letter mappings and volume GUIDs, not serial numbers or first-connection timestamps for USB devices. Option C is wrong because ShellBags tracks folder view settings and window positions for Explorer, not USB device enumeration or serial numbers. Option D is wrong because the USB key under Enum contains generic USB hub and controller descriptors, not the USB mass storage device instances with serial numbers that USBSTOR provides.

Practice this question →
13
MCQmedium

A security analyst is reviewing firewall logs and notices repeated connection attempts from an internal IP to an external server on TCP port 4444. The internal host is a web server. What is the MOST likely explanation?

A.The web server is serving HTTPS traffic on port 4444
B.The web server is performing DNS queries
C.The web server is being scanned for open ports
D.The web server has a reverse shell connection to a command-and-control server
AnswerD

An outbound TCP connection from a compromised web server to a single external IP on a non-standard high port such as 4444 is a classic reverse-shell indicator. Because the server initiates the connection, it can evade typical inbound firewall restrictions, allowing an attacker to receive a shell session through a listener on the command-and-control host. The repeated nature of the connections suggests beaconing for instructions, a hallmark of C2 communication.

Why this answer

Repeated outbound connections from an internal web server to an external server on TCP port 4444 strongly indicate a reverse shell, which is a common technique used by malware to establish command-and-control (C2) communication. Unlike a standard client-server model, the internal host initiates the connection to bypass firewalls that block inbound traffic, and port 4444 is frequently associated with Metasploit's default reverse shell payload (e.g., meterpreter). This behavior is anomalous for a web server, which typically serves HTTP/HTTPS on ports 80/443 and does not initiate persistent outbound connections to arbitrary external IPs on non-standard ports.

Exam trap

The key trap here is that candidates see 'connection attempts' and assume it is an inbound scan (Option C), but the question specifies the internal IP is the source, meaning the web server is initiating the connection, which is the hallmark of a reverse shell or C2 beacon. In CHFI, understanding traffic direction and common C2 port usage is critical.

How to eliminate wrong answers

Option A is wrong because HTTPS traffic is served on TCP port 443 by default, not 4444; while a server could be configured to use a non-standard port, a web server serving HTTPS would not repeatedly initiate outbound connections to an external server—it would listen for inbound connections. Option B is wrong because DNS queries use UDP port 53 (or TCP port 53 for zone transfers), not TCP port 4444, and DNS traffic is typically ephemeral and not characterized by repeated connection attempts to a single external IP. Option C is wrong because a port scan would originate from an external source targeting the internal web server, not from the internal web server to an external server; the log shows outbound connections from the internal host, indicating it is the initiator, not the target of a scan.

Practice this question →
14
MCQeasy

In a macOS forensic investigation, which log system provides a timeline of high-level system events such as application launches and user logins?

A.syslog
B.FSEvents
C..plist files
D.Unified logging
AnswerD

Unified logging is the modern, centralized logging architecture on macOS, introduced in macOS 10.12, which aggregates all system and user-level log messages into a high-performance, structured data store accessible via the `log` command and Console app. It captures high-level forensic events such as logon/logoff, application launches, and background daemon activity, along with rich metadata like timestamps, process IDs, and privacy-annotated content. This makes Unified logging the authoritative artifact for investigating high-level system events because it provides a unified, queryable, and tamper-resistant timeline of system activity.

Why this answer

Unified logging is the correct answer because it is the comprehensive logging system in macOS that captures high-level system events such as application launches and user logins, providing a timeline for forensic analysis. FSEvents, on the other hand, only records file system changes at the directory level.

Exam trap

Candidates may incorrectly assume that FSEvents records high-level system events due to its name, but it only captures file system changes. Unified logging is the primary source for application launches and user logins.

How to eliminate wrong answers

Option A is wrong because syslog is a legacy Unix logging system that collects kernel and application messages but does not specifically track high-level system events like application launches or user logins in a structured timeline; it is more generic and less forensically focused on user actions. Option C is wrong because .plist files are property list files used for storing application preferences and configuration data, not for logging system events or providing a timeline of user activity. Option D is wrong because Unified logging (os_log) is the modern macOS logging framework that captures detailed debug and system messages, but it is not designed to provide a persistent, high-level timeline of events like FSEvents; it is more granular and ephemeral unless specifically configured for persistence.

Practice this question →
15
MCQmedium

During a forensic examination of a Mac system, an investigator needs to recover historical record of file system events, such as file modifications and deletions. Which artifact should they examine?

A..plist files
B.Unified logging
C.Syslog
D.FSEvents
AnswerD

FSEvents is a Mac feature that records changes to the file system, including modifications and deletions.

Why this answer

FSEvents (File System Events) is a macOS framework that logs historical file system changes, including modifications, deletions, and renames, at the volume level. This data is stored in the `.fseventsd` directory and can be queried using the `fsevents` command or tools like `fs_usage`, making it the primary artifact for recovering a timeline of file system activity on a Mac.

Exam trap

EC-Council often tests the distinction between general logging mechanisms (Unified logging, Syslog) and macOS-specific file system event tracking (FSEvents), leading candidates to confuse system logs with dedicated file system change journals.

How to eliminate wrong answers

Option A is wrong because .plist files (property lists) store application preferences and configuration data, not a historical record of file system events like modifications or deletions. Option B is wrong because Unified logging captures system and application log messages via the `log` command, but it does not specifically record file system event history; it focuses on process and kernel logs. Option C is wrong because Syslog is a legacy logging protocol (RFC 5424) that collects system messages but lacks the dedicated file system event tracking and persistent history that FSEvents provides on macOS.

Practice this question →
16
Multi-Selectmedium

A forensic analyst is investigating a Windows system for persistence mechanisms. Which TWO registry locations are commonly used by malware to achieve auto-start? (Select TWO.)

Select 2 answers
A.HKLM\SYSTEM\CurrentControlSet\Services
B.HKLM\SAM\SAM
C.HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
D.HKCU\Software\Microsoft\Windows\CurrentVersion\Run
E.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AnswersD, E

This is the Run key for the current user.

Why this answer

The HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard auto-start location where malware can add entries to execute programs when a user logs in. This key is commonly abused because it does not require administrative privileges to modify, making it a frequent persistence mechanism for user-level malware.

Exam trap

In the CHFI exam, the trap here is that candidates may confuse the Run keys with other persistence locations like the Services key (Option A) or Winlogon (Option C), but the question specifically asks for the two most common auto-start registry locations, which are the HKLM and HKCU Run keys.

Practice this question →
17
MCQmedium

A security analyst reviews Windows Security Event Logs and finds multiple Event ID 4625 entries from a single source IP address targeting various usernames. Which type of attack is MOST likely occurring?

A.Password spraying attack
B.Brute-force attack on a single account
C.Pass-the-hash attack
D.Kerberoasting attack
AnswerA

Password spraying is a low-and-slow attack in which an adversary chooses a handful of common passwords and tries them individually across many user accounts from a single source IP. In Windows Security logs this manifests as multiple Event ID 4625 failed-logon events with different account names but the same source workstation/IP and a common failure code such as 0xC000006D, often within a short window. Because each account is hit only once or twice, the total event volume stays low, evading threshold-based brute-force detection while still matching the observed pattern of many usernames from the same source.

Why this answer

Event ID 4625 indicates a failed logon attempt. When multiple usernames are targeted from a single source IP, it suggests the attacker is trying a small set of common passwords against many accounts to avoid account lockout thresholds. This is the hallmark of a password spraying attack, which differs from a brute-force attack that focuses on many passwords for one account.

Exam trap

EC-Council often tests the distinction between 'many passwords, one user' (brute-force) and 'few passwords, many users' (password spraying), and the trap here is that candidates see multiple failed logons and immediately think brute-force, overlooking the pattern of multiple usernames from a single IP.

How to eliminate wrong answers

Option B is wrong because a brute-force attack on a single account would show repeated 4625 events for the same username, not multiple different usernames. Option C is wrong because a pass-the-hash attack uses NTLM hash values to authenticate without needing the plaintext password, and it typically results in successful logon events (Event ID 4624), not a series of failed logons. Option D is wrong because Kerberoasting targets service accounts by requesting Kerberos service tickets (TGS-REQ) and does not generate Event ID 4625; it instead produces Event ID 4769 with specific attributes.

Practice this question →
18
MCQeasy

A security analyst reviews Windows Security Event Log and observes Event ID 4625 repeatedly for a single user account from a remote IP address within a short timeframe. What is the MOST likely cause?

A.The user successfully logged on from a remote workstation
B.A brute-force password attack is occurring against that account
C.The user's account was created
D.A service was installed on the system
AnswerB

Repeated failed logons from a remote IP indicate a brute-force attack.

Why this answer

Event ID 4625 indicates a failed logon attempt. When this event is logged repeatedly for the same user account from a single remote IP address within a short timeframe, it is a classic indicator of an automated brute-force password attack, where an attacker tries many passwords against that account in rapid succession.

Exam trap

The trap here is that candidates may confuse Event ID 4625 with a successful logon (4624) or think it indicates account creation, but the CHFI exam tests the precise mapping of Event IDs to security events to catch those who rely on vague memory rather than exact knowledge.

How to eliminate wrong answers

Option A is wrong because Event ID 4625 specifically denotes a failed logon, not a successful one (which would be Event ID 4624). Option C is wrong because account creation is logged as Event ID 4720, not 4625. Option D is wrong because service installation generates Event ID 4697 (or 7045 in the System log), not 4625.

Practice this question →
19
MCQmedium

Which Windows artifact is specifically designed to track the most recently used (MRU) files for specific applications and can be found in the NTUSER.DAT registry hive?

A.Prefetch files
B.Jump Lists
C.MRU lists in the registry
D.LNK files
AnswerC

Most Recently Used (MRU) lists in the registry are exactly the artifact designed for tracking recently opened files. For example, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU stores PIDLs of files selected through common dialog boxes, while application-specific keys like HKCU\Software\Microsoft\Notepad and HKCU\Software\Microsoft\WordPad record the last file paths opened by those applications. These registry values are maintained by the operating system and applications specifically to store this historical MRU data, making them the canonical answer.

Why this answer

The NTUSER.DAT registry hive contains per-user MRU (Most Recently Used) lists that track files recently accessed by specific applications, such as the 'RecentDocs' key for Office applications or 'ComDlg32' for common dialog boxes. These registry keys are explicitly designed to store MRU data, making them the direct artifact for this purpose.

Exam trap

EC-Council often tests the distinction between registry-based MRU lists (stored in NTUSER.DAT) and file-system artifacts like Jump Lists or LNK files, so candidates mistakenly choose Jump Lists because they also track recent files, but they are not stored in the registry hive.

How to eliminate wrong answers

Option A is wrong because Prefetch files are located in the C:\Windows\Prefetch folder and track application launch sequences and file paths for system-wide performance optimization, not per-user MRU lists in the registry. Option B is wrong because Jump Lists are stored as .customDestinations-ms files in the user's AppData\Roaming\Microsoft\Windows\Recent directory and provide a graphical list of recent files for taskbar applications, but they are not stored in the NTUSER.DAT hive. Option D is wrong because LNK files (shortcuts) are stored in the user's Recent folder and other locations, tracking file access via shell link data, but they are not registry-based MRU lists within NTUSER.DAT.

Practice this question →
20
MCQhard

During a network forensic investigation, the analyst examines firewall logs and notices a large number of outbound connections from an internal server to various IP addresses on port 443 at regular intervals. The connections are all initiated by a process called 'svchost.exe' running from a non-standard location (C:\Windows\Temp). What is the MOST likely explanation?

A.The server is running a scheduled backup to an external cloud service
B.The server is performing legitimate Windows Update checks
C.The server is infected with malware that is beaconing to a command-and-control server
D.The server is being used as a proxy for internal users
AnswerC

The correct indicator set is process-name spoofing combined with network beaconing: the malware uses the legitimate name svchost.exe but executes from the Temp folder, which no built-in Windows service does because the Service Control Manager loads service binaries using the full ImagePath—normally C:\Windows\System32\svchost.exe. The attacker then creates periodic outbound connections at fixed or jittered intervals to a small set of external IPs, typically carrying small, encrypted payloads, to receive commands or exfiltrate data—a classic C2 beacon signature. Defenders observe a single host producing repeatable timing patterns with low data volume per connection, which is nearly pathognomonic for malware.

Why this answer

Svchost.exe running from C:\Windows\Temp is a classic sign of malware masquerading as a legitimate Windows process. The regular outbound connections on port 443 (HTTPS) at fixed intervals indicate beaconing behavior, where the infected host periodically contacts a command-and-control (C2) server to receive instructions or exfiltrate data. Legitimate svchost.exe resides in C:\Windows\System32, and any deviation from this path is a strong indicator of compromise.

Exam trap

EC-Council CHFI exam often tests the misconception that svchost.exe is always legitimate, but the key trap here is that the process path (C:\Windows\Temp) is abnormal, and candidates may overlook this detail and incorrectly assume the activity is a normal Windows Update or backup operation.

How to eliminate wrong answers

Option A is wrong because scheduled backups to cloud services typically use dedicated backup software or Windows Server Backup, not svchost.exe from a non-standard path, and would not exhibit regular beaconing intervals. Option B is wrong because legitimate Windows Update checks use svchost.exe from C:\Windows\System32, not C:\Windows\Temp, and updates are initiated by the Windows Update service (wuauserv) via HTTP/HTTPS on port 80/443 but not at rigidly regular intervals. Option D is wrong because using a server as a proxy for internal users would involve a proxy service (e.g., Squid, Microsoft TMG) or a configured proxy role, not svchost.exe from a temp directory, and would show connections from multiple internal clients, not just outbound from the server.

Practice this question →
21
MCQmedium

A forensic investigator is examining a Mac system and wants to review recently accessed files and applications. Which macOS artifact is MOST useful for this purpose?

A.bash_history
B..plist files in ~/Library/Preferences/
C.Unified Logging (log stream)
D.FSEvents (/.fseventsd)
AnswerD

FSEvents records file system changes and can be used to reconstruct user activity.

Why this answer

FSEvents (/.fseventsd) is the correct choice because it maintains a persistent, chronological record of file system changes on macOS, including file accesses and modifications. This artifact allows an investigator to reconstruct a timeline of recently accessed files and applications, as the FSEvents daemon logs events such as file opens, renames, and deletions at the volume level, making it the most direct source for this purpose.

Exam trap

EC-Council often tests the misconception that bash_history is the primary source for user activity on macOS, but the trap here is that FSEvents provides a more comprehensive and persistent record of file accesses and application launches, including those not performed via the command line.

How to eliminate wrong answers

Option A is wrong because bash_history only records commands entered in the Bash shell, not file accesses or application launches outside the terminal, and it can be easily cleared or bypassed. Option B is wrong because .plist files in ~/Library/Preferences/ store application settings and user preferences, not a comprehensive log of file access events; they may indicate which apps were used but lack timestamps and file-level access details. Option C is wrong because Unified Logging (log stream) captures system-wide diagnostic messages and can include some file access events, but it is not optimized for forensic timeline reconstruction of file accesses and is often filtered or pruned, whereas FSEvents is specifically designed for this purpose.

Practice this question →
22
MCQmedium

During a Windows forensic analysis, you find a suspicious LNK file in a user's Recent folder. Which of the following is NOT typically retrievable from an LNK file?

A.Username of the user who created the LNK file
B.Target file creation timestamp
C.Volume serial number of the target drive
D.Target file path
AnswerA

The Shell Link binary format has no dedicated field for the creating user's username or SID. LNK files identify the machine via the MachineID string and the target volume via a serial number, but attribution to a specific account must be reconstructed through indirect evidence like the NTFS USN journal, Prefetch, or shellbags, not read directly from the .lnk file.

Why this answer

LNK files store metadata about the target file and the system environment, but they do not record the username of the user who created the LNK file. The creation timestamp of the LNK file itself is stored, but the username is not part of the LNK file structure. Instead, the username context is inferred from the user's profile folder path where the LNK resides, not from the file's internal data.

Exam trap

EC-Council CHFI often tests the misconception that LNK files store the creator's username because they associate the file with a user's Recent folder, but the username is derived from the folder path, not the file's internal data.

How to eliminate wrong answers

Option B is wrong because LNK files do store the target file's creation timestamp in the shell link header (as a FILETIME structure). Option C is wrong because the volume serial number of the target drive is stored in the volume ID structure within the LNK file. Option D is wrong because the target file path is stored in the link target identifier (ITPIDLIST) and the link info structure, making it fully retrievable.

Practice this question →
23
Multi-Selecteasy

A forensic analyst reviews a Windows system for signs of malware persistence. Which TWO registry locations are commonly used to achieve persistence via auto-start programs?

Select 2 answers
A.HKLM\SAM\SAM\Domains\Account\Users
B.HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
C.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
D.HKLM\SYSTEM\CurrentControlSet\Services
E.HKCU\Software\Microsoft\Windows\CurrentVersion\Run
AnswersC, E

This HKLM Run key is a critical persistence location: at every user logon, the Winlogon process reads it and launches each listed executable for all accounts, requiring administrative privileges to modify. Values are command lines (e.g., 'C:\malware.exe') that run early in the logon sequence, before the desktop is fully interactive. Because it has system-wide scope, it is a top target for malware persistence and a primary check during a forensic investigation for auto-start mechanisms.

Why this answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKCU\Software\Microsoft\Windows\CurrentVersion\Run are standard auto-start locations for all users and current user respectively. RunOnce keys execute once and are also used. But the most common are Run keys.

Practice this question →
24
MCQmedium

A security analyst observes multiple Event ID 4625 logon failures for a single user account within a short time frame, followed by Event ID 4624 logon success. Which attack technique is MOST likely indicated?

A.Kerberos golden ticket attack
B.SQL injection attack on the authentication database
C.Brute-force or password spraying attack
D.Pass-the-hash attack
AnswerC

The correct finding: a burst of 4625 events followed by a 4624 event is the canonical signature of brute-force or password-spraying. Brute-force creates many failed attempts per target account with different passwords, while spraying uses one password across many accounts; both generate numerous 4625 audit records. When one guess finally matches, a 4624 success appears, confirming the attack succeeded.

Why this answer

Event ID 4625 indicates failed logon attempts, and Event ID 4624 indicates a successful logon. A rapid sequence of failures followed by a success for the same user account is the classic signature of a brute-force or password spraying attack, where an attacker tries multiple passwords until one works. This pattern is specific to authentication attempts against the local SAM or domain controller via NTLM or Kerberos, not to post-authentication attacks.

Exam trap

EC-CHFI often tests the distinction between pre-authentication attacks (brute-force, password spraying) and post-authentication attacks (pass-the-hash, golden ticket), where candidates mistakenly associate any successful logon after failures with a hash-based attack instead of recognizing the sequential failure-success pattern as brute-force.

How to eliminate wrong answers

Option A is wrong because a Kerberos golden ticket attack forges a Ticket Granting Ticket (TGT) using the KRBTGT hash, which does not generate multiple Event ID 4625 failures; instead, it produces a single successful logon (4624) with unusual attributes like a non-existent user or anomalous ticket options. Option B is wrong because SQL injection targets the database query layer, not Windows Security Log events 4625/4624; it would generate SQL server errors or application-level logs, not sequential logon failures. Option D is wrong because a pass-the-hash attack uses stolen NTLM hashes to authenticate without knowing the plaintext password, typically resulting in a single successful logon (4624) without preceding 4625 failures, as the hash is valid.

Practice this question →
25
MCQmedium

A security analyst reviewing Windows Security Event Logs sees multiple Event ID 4625 entries for a single user account, followed by a successful Event ID 4624. The account is a domain administrator. What is the MOST likely explanation?

A.The user typed their password incorrectly several times before succeeding
B.The system experienced a denial of service attack
C.An attacker performed a brute-force password attack and succeeded
D.A misconfigured application caused repeated logon attempts
AnswerC

Multiple failed logon attempts followed by a successful logon, especially on a privileged account, strongly suggests a brute-force attack.

Why this answer

Event ID 4625 indicates a failed logon attempt, while Event ID 4624 indicates a successful logon. A sequence of multiple 4625 events for the same domain administrator account followed by a single 4624 event is the classic signature of a successful brute-force password attack, where an attacker systematically tries passwords until one works. The fact that the account is a domain administrator makes it a high-value target, and the pattern of failures then success is inconsistent with simple user error or misconfiguration.

Exam trap

The trap here is that candidates confuse a brute-force attack (multiple failures from a single account) with a user simply mistyping their password, but the key differentiator is the volume of failures and the targeted nature of a domain administrator account, which is a high-value target for attackers.

How to eliminate wrong answers

Option A is wrong because a user typing their password incorrectly several times before succeeding would typically show a small number of 4625 events (e.g., 3–5) with no specific pattern, but the question implies multiple failures, and a domain administrator is unlikely to repeatedly mistype their password without triggering account lockout policies. Option B is wrong because a denial of service attack would generate a high volume of logon failures from many different accounts or IPs, not a single account followed by a success, and Event ID 4625 alone does not indicate DoS; DoS attacks target service availability, not authentication. Option D is wrong because a misconfigured application would typically produce consistent, periodic 4625 events (e.g., every few minutes) from the same service account or system account, not a single user account followed by a successful logon, and it would not target a domain administrator account specifically.

Practice this question →
26
MCQmedium

An investigator is analyzing a Windows 10 system suspected of malware persistence. Which registry key is commonly used by malware to achieve persistence by running a program at every user logon?

A.HKLM\SAM\SAM
B.HKLM\SYSTEM\CurrentControlSet\Services
C.HKCU\Software\Microsoft\Windows\CurrentVersion\Run
D.HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall
AnswerC

This is the canonical per-user Autorun key: when the user logs in, Winlogon/Explorer enumerates values under HKCU\Software\Microsoft\Windows\CurrentVersion\Run and launches each command line, making it the exact location an investigator should inspect for a user-specific startup program. The HKCU hive is loaded from the user's NTUSER.DAT, so findings here are tied to a single profile. Because the question asks about a Windows 10 user logon startup, this key is the correct answer.

Why this answer

The HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard autostart location that Windows checks at every user logon. Malware commonly writes a value here pointing to its executable path, ensuring it runs automatically each time the user logs into their account. This is a well-documented persistence mechanism in Windows forensics.

Exam trap

The trap here is that candidates confuse the Run key with the Services key (Option B), thinking that any service can achieve per-user logon persistence, but services run under the SYSTEM account and are not triggered by user logon unless specifically configured with a trigger-start service or by setting the service to 'Automatic' and relying on delayed start, which is not the standard per-user logon mechanism.

How to eliminate wrong answers

Option A is wrong because HKLM\SAM\SAM stores the Security Account Manager database containing user password hashes and local account information, not autostart locations; it is unrelated to program persistence at logon. Option B is wrong because HKLM\SYSTEM\CurrentControlSet\Services is used to register Windows services that start automatically with the system (e.g., at boot), not specifically at every user logon; while services can be configured for delayed start or automatic start, the Run key is the direct per-user logon mechanism. Option D is wrong because HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall stores uninstallation metadata for installed applications, not autostart entries; malware would not use this key to achieve persistence.

Practice this question →
27
Multi-Selecteasy

During a Windows forensic investigation, an analyst finds prefetch files with the .pf extension. Which TWO pieces of information can the analyst obtain from analyzing prefetch files?

Select 2 answers
A.The number of times the application has been executed
B.The exact date and time of each execution
C.The username that executed the application
D.The command-line arguments used to launch the program
E.The IP addresses the application connected to
AnswersA, B

Prefetch stores a run counter.

Why this answer

Prefetch files in Windows store execution count and timestamps of application launches. The .pf file header contains a run count field that increments each time the application is executed, and the file also records up to eight previous execution timestamps. This allows the analyst to determine how many times the application was run and the exact date and time of each execution, making A and B correct.

Exam trap

A common misconception is that prefetch files contain user-specific data or command-line arguments, but they only store execution count and timestamps, not user identity or process invocation details.

Practice this question →
28
MCQeasy

A forensic analyst is performing timeline analysis on a compromised system. Which tool is specifically designed to parse multiple log sources and create a super timeline?

A.Sleuth Kit
B.log2timeline
C.Volatility
D.Wireshark
AnswerB

log2timeline (part of Plaso) is designed to create super timelines from multiple sources.

Why this answer

log2timeline (now part of the plaso framework) is specifically designed to parse multiple log sources—such as Windows Event Logs, syslog, web server logs, and file system metadata—and aggregate them into a single super timeline. This enables forensic analysts to correlate events across disparate logs for timeline analysis, which is exactly the requirement in the question.

Exam trap

EC-Council often tests the distinction between disk forensics tools (Sleuth Kit), memory forensics tools (Volatility), network forensics tools (Wireshark), and timeline/log analysis tools (log2timeline), so candidates mistakenly choose a tool they recognize from other forensics domains without reading the specific requirement for parsing multiple log sources.

How to eliminate wrong answers

Option A is wrong because Sleuth Kit is a collection of command-line tools for analyzing disk images and file system structures (e.g., extracting deleted files, viewing MFT entries), not for parsing multiple log sources to create a super timeline. Option C is wrong because Volatility is a memory forensics framework used to analyze RAM dumps (e.g., processes, network connections, registry hives in memory), not for parsing log files from disk. Option D is wrong because Wireshark is a network protocol analyzer that captures and inspects live or recorded packet captures (pcap files), not for parsing system or application logs into a timeline.

Practice this question →
29
Multi-Selectmedium

Which TWO Windows Event IDs are associated with successful logon or explicit credential usage? (Choose TWO.)

Select 2 answers
A.4648
B.4720
C.4624
D.4625
E.7045
AnswersA, C

Event ID 4648 records a logon attempt using explicit credentials, such as when a user runs a process with `runas` or supplies alternate domain credentials for a network connection. This satisfies the stem’s constraint of “explicit credential usage” because the event logs the target account and the source process, distinguishing it from interactive logon events like 4624.

Why this answer

Event ID 4648 is logged when a user attempts to log on using explicit credentials, such as running a program as a different user or using the 'runas' command. Event ID 4624 is logged for every successful local or remote logon session, including interactive, network, and service logons. Both are standard Windows Security log events used in forensic analysis to track authentication activity.

Exam trap

The trap here is that candidates often confuse Event ID 4625 (failed logon) with 4624 (successful logon), or mistakenly associate 4720 (account creation) with logon activity, while overlooking the specific purpose of 4648 for explicit credential usage.

Practice this question →
30
MCQeasy

Which Linux log file is the PRIMARY source for authentication-related events such as user logins, sudo usage, and failed authentication attempts?

A./var/log/kern.log
B./var/log/syslog
C./var/log/boot.log
D./var/log/auth.log
AnswerD

auth.log records authentication events.

Why this answer

/var/log/auth.log is the primary log file on Linux systems (especially Debian/Ubuntu) that records authentication-related events, including user logins (via sshd, login, su), sudo command executions, and failed authentication attempts. This log is generated by the authpriv facility in syslog and is specifically designed to capture security and authentication messages, making it the go-to source for forensic analysis of user access and privilege escalation.

Exam trap

In EC-CHFI, candidates often confuse /var/log/syslog with /var/log/auth.log, thinking syslog captures all system events. However, authentication events are specifically routed to a separate file (auth.log or secure) for security isolation and forensic analysis of user access.

How to eliminate wrong answers

Option A is wrong because /var/log/kern.log contains kernel messages (e.g., driver errors, hardware events) and does not log user authentication or sudo usage. Option B is wrong because /var/log/syslog captures general system messages (e.g., daemon logs, cron jobs) but not the authpriv facility by default; authentication events are typically excluded from syslog to separate security-relevant data. Option C is wrong because /var/log/boot.log records boot-time messages from the init system (e.g., systemd or SysV) and has no relation to runtime authentication events like logins or sudo.

Practice this question →
31
MCQeasy

Which tool is commonly used in timeline analysis for digital forensics to parse various artifacts and create a super timeline?

A.Volatility
B.Wireshark
C.Sleuth Kit
D.log2timeline / Plaso
AnswerD

log2timeline (now evolved into Plaso) is the definitive open-source tool for digital forensics timeline analysis. It recursively parses a disk image or collection of files, using numerous parsers to extract timestamps from file system metadata, operating system logs, application traces, browser history, registry keys, and many other artifact types. All parsed timestamps are normalized into a unified SQLite database, enabling the investigator to generate a 'super timeline' that correlates events across multiple sources for temporal reconstruction. This comprehensive multi-source approach is exactly what timeline analysis demands, making it the correct answer.

Why this answer

log2timeline (now part of the Plaso framework) is specifically designed to parse a wide variety of digital forensic artifacts—such as Windows Event Logs, Prefetch files, registry hives, and browser history—and aggregate them into a single, unified super timeline. This super timeline allows investigators to correlate events across different data sources and identify sequences of activity with precise timestamps, which is essential for timeline analysis in OS and network forensics.

Exam trap

EC-Council often tests the distinction between low-level filesystem tools (like Sleuth Kit) and high-level artifact parsing tools (like log2timeline/Plaso), leading candidates to mistakenly choose Sleuth Kit because they associate 'timeline analysis' with file timestamps (MAC times) rather than the comprehensive super timeline that aggregates multiple artifact types.

How to eliminate wrong answers

Option A is wrong because Volatility is a memory forensics framework used for analyzing RAM dumps (e.g., processes, network connections, registry hives in memory), not for parsing filesystem artifacts to build a super timeline. Option B is wrong because Wireshark is a network packet analyzer that captures and inspects live or recorded network traffic (e.g., TCP/IP packets), not a tool for parsing local OS artifacts or generating timelines. Option C is wrong because Sleuth Kit (TSK) provides low-level filesystem analysis tools (e.g., fls, icat, mmls) and can extract file metadata and recover deleted files, but it does not natively parse high-level application artifacts or produce a unified super timeline; that requires additional scripting or integration with tools like log2timeline.

Practice this question →
32
MCQmedium

A security analyst detects a sudden spike in failed logon events with Event ID 4625 on a Windows domain controller. The source IP addresses are random and from various external subnets. Which type of attack is MOST likely occurring?

A.Pass‑the‑hash attack
B.Kerberos ticket forgery (Golden Ticket)
C.Insider threat with compromised credentials
D.Brute‑force attack
AnswerD

Each 4625 event explicitly records an authentication failure with logon type, source IP, and username, so a sudden spike from many different source addresses targeting the same accounts is the hallmark of a distributed password-guessing attack. The attacker submits candidate passwords over RDP, SMB, or VPN until one succeeds, which is exactly why the failed-logon count spikes before eventual access. The varied external IPs and volume distinguish this from credential misuse or ticket-forging attacks.

Why this answer

Event ID 4625 indicates a failed logon attempt. A sudden spike from random, external source IPs is characteristic of a brute-force attack, where an attacker systematically tries many username/password combinations against the domain controller. This pattern does not match the stealthier or more targeted nature of the other attack types.

Exam trap

EC-Council often tests the distinction between a brute-force attack (many failed logons from varied IPs) and a pass-the-hash attack (which uses a valid hash and does not generate failed logon events), leading candidates to confuse the two when they see Event ID 4625.

How to eliminate wrong answers

Option A is wrong because a pass-the-hash attack uses captured NTLM hashes to authenticate without needing the plaintext password, and it typically originates from a compromised internal host, not from random external IPs. Option B is wrong because Kerberos ticket forgery (Golden Ticket) involves forging a Kerberos TGT using the KRBTGT hash, which does not generate a spike in failed logon events (Event ID 4625) from external sources. Option C is wrong because an insider threat with compromised credentials would likely show successful logons or a targeted pattern, not a high volume of failed attempts from many random external subnets.

Practice this question →

Ready to test yourself?

Try a timed practice session using only OS and Network Forensics questions.

Start 20-question session