How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the CHFI exam, each with detailed explanations and wrong-answer analysis.

How should I approach CHFI scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Computer Hacking Forensic Investigator CHFI questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Computer Hacking Forensic Investigator CHFI practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CHFI

exam code

EC-Council

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1easymulti select

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related CHFI topic practice pages

Computer Forensics Investigation Process practice questions

Computer Forensics Fundamentals and Process practice questions

Storage Forensics and File System Analysis practice questions

Incident Response and First Responder Skills practice questions

Computer Forensics Lab practice questions

Evidence Acquisition and Duplication practice questions

OS and Network Forensics practice questions

OS and File System Forensics practice questions

Application, Email and Cloud Forensics practice questions

Mobile and Malware Forensics practice questions

Network and Cloud Forensics practice questions

Database and Application Forensics practice questions

Practice scenarios

Which TWO of the following are valid reasons for using a hardware write blocker during disk acquisition? (Choose two.)

Which TWO of the following are valid techniques for collecting volatile network evidence from a live system during incident response?

A first responder is responding to a ransomware incident on a Windows server. Which TWO actions should be performed to preserve evidence? (Choose two.)

Which THREE of the following are indicators of malware persistence via registry run keys? (Choose three.)

Which THREE of the following are essential steps in the incident response process as defined by NIST SP 800-61? (Select exactly 3.)

Which TWO of the following are considered essential steps in the computer forensics investigation process according to EC-Council guidelines?

Which THREE of the following are recommended practices for maintaining the integrity of digital evidence in a forensics lab?

Which THREE of the following are essential steps in network forensic investigation?

Which TWO of the following are effective methods for detecting a man-in-the-middle attack on a network?

Which TWO of the following are valid methods for collecting volatile data from a live database server during an incident response?

Which THREE of the following are essential steps in the forensic analysis of a compromised web application that uses a MySQL backend?

Which THREE of the following are best practices for conducting malware forensics in a safe and effective manner?

Which TWO of the following are common indicators of a rootkit infection on a Windows system?

Which TWO of the following are valid locations in a Windows system where forensic evidence of USB device connection can be found?

A mobile forensic examiner is analyzing an Android device that has been factory reset. Which TWO of the following artefacts are MOST likely to still be recoverable after a factory reset? (Select TWO)

An analyst is investigating a potential data breach on an Android device. Which TWO artefacts are MOST useful for determining which third-party apps were installed and used? (Select TWO.)

Which TWO of the following are anti-forensic techniques used by malware to evade detection?

A forensic analyst is examining an Android device using ADB extraction. Which TWO statements about ADB extraction are true?

An incident responder is analyzing a compromised Windows workstation. Which TWO artifacts would provide the STRONGEST evidence of a malware persistence mechanism?