How many Refer to the Exhibit Practice Questions questions are on this page?

This page has 13 Refer to the Exhibit Practice Questions scenario questions for the CHFI exam, each with detailed explanations and wrong-answer analysis.

How should I approach CHFI scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Computer Hacking Forensic Investigator CHFI questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Computer Hacking Forensic Investigator CHFI practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CHFI

exam code

EC-Council

vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Practice scenarios

Question 1easymultiple choice

Full question →

Refer to the exhibit. A first responder runs the netstat command on a compromised Windows workstation. Which of the following conclusions is BEST supported by the output?

Exhibit

Refer to the exhibit.

C:\Users\Forensic> netstat -ano

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    192.168.1.10:49152     10.2.3.4:443           ESTABLISHED     1234
  TCP    192.168.1.10:49153     192.168.1.1:80         TIME_WAIT       0
  TCP    192.168.1.10:49154     10.2.3.4:80            ESTABLISHED     1234
  UDP    0.0.0.0:5353           *:*                                    5678

A
The connection to 192.168.1.1:80 is suspicious because it is in TIME_WAIT state.
Why wrong: TIME_WAIT is a normal TCP state for closed connections.
B
The UDP listener on port 5353 indicates a malware infection.
Why wrong: Port 5353 is commonly used by mDNS (Bonjour) and is often benign.
C
A process with PID 1234 is likely communicating with a remote C2 server at 10.2.3.4.
Process 1234 has two established connections to the same remote IP on different ports.
D
The workstation is running multiple virtual machines based on the local addresses.
Why wrong: Only one local IP is shown.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

Refer to the exhibit. The FTK Imager output shows a disk with an NTFS partition. The examiner notes that the $MFT mirror is at cluster 2. What is the logical size of the $MFT mirror in bytes?

Exhibit

Refer to the exhibit.

FTK Imager command output:

Sector size: 512
Total sectors: 625142448
Partition start: 2048
Partition end: 625139712
Partition type: NTFS (07)

Flags: 0x80 (Bootable)

File system: NTFS
Volume label: EVIDENCE_DRIVE
Serial number: 1234-5678

$MFT mirror: cluster 2
$MFT: cluster 0
Clusters per record: 1
Bytes per cluster: 4096

A
320 GB
Why wrong: Incorrect: This is the total disk capacity, not the $MFT mirror size.
B
512 bytes
Why wrong: Incorrect: 512 bytes is the sector size, not the $MFT mirror size.
C
4096 bytes
Correct: The $MFT mirror occupies one cluster (4096 bytes) when clusters per record = 1.
D
8192 bytes
Why wrong: Incorrect: This would be two clusters, but the output shows clusters per record = 1.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

Refer to the exhibit. During a malware investigation, a forensic analyst runs the commands shown. What is the most likely conclusion?

Exhibit

Refer to the exhibit.

C:\> tasklist /svc
Image Name                     PID Services
========================= ======== ============================================
svchost.exe                   1236 CryptSvc, Dnscache, LmHosts, EventSystem
svchost.exe                   1344 W32Time, WdiServiceHost
svchost.exe                    768 BFE, MpsSvc
notepad.exe                   1456 N/A
svchost.exe                    524 SessionEnv, TermService, UmRdpService
rundll32.exe                  1500 N/A

C:\> netstat -ano | findstr :4444
  TCP    0.0.0.0:4444           0.0.0.0:0              LISTENING       1500

C:\> wmic process where processid=1500 get executablepath
ExecutablePath
C:\Windows\System32\rundll32.exe

A
Svchost.exe processes are hosting legitimate Windows services; no malware is present.
Why wrong: Svchost.exe hosting many services is normal, but the network connection on port 4444 is suspicious.
B
The malware has injected code into svchost.exe using a reflective DLL injection tool.
Why wrong: No evidence of injection into svchost.exe; the suspicious process is rundll32.exe.
C
The malware is using port 4444 for Windows Update communications.
Why wrong: Windows Update does not use port 4444; it uses port 80/443.
D
Rundll32.exe with PID 1500 is likely a backdoor listening on port 4444.
Rundll32.exe typically does not listen on network ports; PID 1500 is listening on a suspicious port, indicating malware.

Full breakdown with real-world context →

Question 4easymultiple choice

Full question →

Based on the log exhibit, what type of attack is occurring?

Exhibit

Refer to the exhibit.

Nov 12 09:23:45 server1 sshd[1234]: Failed password for root from 10.0.0.5 port 22 ssh2
Nov 12 09:24:10 server1 sshd[1235]: Failed password for root from 10.0.0.5 port 22 ssh2
Nov 12 09:24:35 server1 sshd[1236]: Failed password for root from 10.0.0.5 port 22 ssh2
... (repeated every 25 seconds)

A
Man-in-the-middle attack
Why wrong: No signs of ARP spoofing or SSL issues.
B
SQL injection attack
Why wrong: Logs are from SSH, not web application.
C
Denial of Service attack
Why wrong: No evidence of service disruption.
D
Brute-force attack on SSH
Repeated failed attempts for root user from same IP.

Full breakdown with real-world context →

Question 5mediummultiple choice

Full question →

Based on the ARP table exhibit, what is the most likely security issue?

Network Topology

A
The gateway is unreachable
Why wrong: The gateway IP (192.168.1.1) has an entry, so it is reachable.
B
Duplicate IP addresses on the network
Why wrong: Duplicate IPs would cause conflicts, but here the MAC is duplicated, not IP.
C
ARP poisoning attack
Multiple IPs with same MAC is a classic sign of ARP spoofing.
D
MAC address filtering is enabled
Why wrong: Filtering would not cause this pattern.

Full breakdown with real-world context →

Question 6mediummultiple choice

Full question →

You are a forensic analyst investigating a suspected malware infection on a Windows 10 workstation. The user reports that the system has been slow and that unexpected pop-ups appear. You have acquired a memory dump and a disk image. During analysis, you find a suspicious process named 'svch0st.exe' running with PID 4567. The process has loaded several DLLs, including 'wininet.dll' and 'ws2_32.dll'. You also find that the process has an active TCP connection to an external IP address 203.0.113.5 on port 4444. In the disk image, you find an executable file at C:\Users\Public\svch0st.exe with a creation date that matches the start of symptoms. The file's hash is not in any known malware database. You decide to perform dynamic analysis by running the file in a sandbox. However, the sandbox environment has no network connectivity. The executable runs but does not exhibit any malicious behavior. What should you do next to determine if the file is malicious?

A
Conduct a thorough static analysis using a disassembler and debugger to understand the code
Why wrong: Static analysis is useful but may not reveal behavior that only triggers under specific conditions, such as network activity.
B
Delete the suspicious file and run a full antivirus scan on the system
Why wrong: Deleting evidence and relying solely on antivirus may miss advanced malware.
C
Re-run the sample in a sandbox with simulated network connectivity or a controlled network to observe C2 communication
Network connectivity may be required for the malware to activate its malicious payload.
D
Perform a forensic imaging of the system again and compare with the original image
Why wrong: Re-imaging does not help determine the file's behavior; dynamic analysis with network is needed.

Full breakdown with real-world context →

Question 7mediummultiple choice

Full question →

Refer to the exhibit. An analyst recovers this binary log entry from a MySQL server. What does the timestamp '190101 10:00:00' represent?

Exhibit

Refer to the exhibit.

```
MySQL Binary Log Entry:
# at 12345678
#190101 10:00:00 server id 1  end_log_pos 12345679 CRC32 0x12345678 	Query	thread_id=100	exec_time=0	error_code=0
SET TIMESTAMP=1546334400/*!*/;
DELETE FROM users WHERE id=5
/*!*/;
```

A
The time the DELETE statement was executed on the MySQL server
The timestamp records when the server executed the statement.
B
The time the client sent the query to the server
Why wrong: The timestamp is server-side, not client-side.
C
The time the binary log file was written to disk
Why wrong: The timestamp is the execution time, not the write time.
D
The time the transaction was committed
Why wrong: For non-transactional statements like DELETE, there is no commit; the timestamp is execution time.

Full breakdown with real-world context →

Question 8mediummultiple choice

Full question →

During a malware investigation, an analyst discovers a suspicious file with a hash value that matches known malware. However, the file fails to execute and does not exhibit any malicious behavior in a sandbox. What is the most likely reason for this discrepancy?

A
The file is a false positive and is actually benign
Why wrong: A false positive would imply the hash does not match known malware; here it does match.
B
The sandbox is not updated with the latest signatures
Why wrong: Hash matching is independent of signatures; the sandbox would still see the file as malicious based on hash.
C
The file's metadata has been modified to evade analysis
Why wrong: Modifying metadata would change the file hash, so the hash would not match known malware.
D
The file is packed or obfuscated to prevent execution in a sandbox
Packing can prevent execution until unpacked, causing the sandbox to not observe malicious behavior.

Full breakdown with real-world context →

Question 9hardmultiple choice

Full question →

Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?

Exhibit

Refer to the exhibit.

C:\> fls -f ntfs -o 2048 image.dd
r/r 4-128-3: $AttrDef
r/r 8-128-2: $BadClus
r/r 6-128-2: $Bitmap
r/r 7-128-1: $Boot
r/r 11-128-3: $Extend
r/r 2-128-1: $LogFile
r/r 0-128-1: $MFT
r/r 1-128-1: $MFTMirr
r/r 9-128-8: $Secure
r/r 10-128-1: $UpCase
r/r 3-128-3: $Volume
r/r 108-128-2: Users
r/r 109-128-3: ProgramData
r/r 110-128-2: Windows
r/r 111-128-1: Program Files
r/r 112-128-1: Program Files (x86)
V/V 113-128-1: $OrphanFiles
r/r 114-128-3: autoexec.bat
r/r 115-128-1: config.sys

A
It is a sign that a rootkit has hidden files in the image
Why wrong: $OrphanFiles is a normal artifact of file system analysis, not a rootkit indicator.
B
It indicates the location of the Master File Table (MFT) mirror
Why wrong: MFT mirror is $MFTMirr, not $OrphanFiles.
C
It is a virtual directory that contains files with no parent directory, often from deleted files
'V/V' denotes a virtual directory for files that are not linked in the directory tree.
D
It is a standard NTFS metadata file that stores file permissions
Why wrong: $OrphanFiles is not a standard NTFS metadata file.

Full breakdown with real-world context →

Question 10hardmultiple choice

Full question →

Refer to the exhibit. A forensic examiner is analyzing a Windows system and sees the above NTFS file metadata. The user claims the file was last accessed at 09:15. Which of the following best explains the discrepancy?

Exhibit

Refer to the exhibit.

=== File System Analysis Report ===
Drive: /dev/sda1 (NTFS)
Inode: 2345
File: critical_data.docx
Creation Time: 2024-03-10 09:15:00 UTC
Last Modified: 2024-03-10 09:20:00 UTC
Last Access: 2024-03-10 09:25:00 UTC
$LogFile Sequence Number: 123456
$UsnJrnl: Entry 7890
=== End of Report ===

A
The $UsnJrnl entry shows the file was modified, and the last access time was updated by the system when the file was opened for reading
The $UsnJrnl records changes; the last access time is updated on read operations, explaining the later timestamp.
B
The system has disabled last access time updates, so the reported times are unreliable
Why wrong: If disabled, the last access time would not change; here it changed to 09:25, so updates are enabled.
C
The creation time is earlier than the last access, indicating the file was copied from another volume
Why wrong: Creation time being earlier than last access is normal; no indication of copying.
D
The $LogFile sequence number indicates a transaction rollback that reset the timestamps
Why wrong: $LogFile is for file system transactions, not for timestamp adjustments.

Full breakdown with real-world context →

Question 11easymultiple choice

Full question →

Refer to the exhibit. An investigator runs the queries on an Oracle database during a live forensic acquisition. What does the output indicate about the database transaction state?

Exhibit

Refer to the exhibit.

```
SQL> SELECT * FROM v$transaction;

ADDR           XIDUSN XIDSLOT XIDSQN  UBAFIL  UBABLK  UBASQN  UBAOFF  STATUS   START_SCNBAS START_SCNWRP
-------------- ------ ------- ------  ------  ------  ------  ------  -------- ------------ ------------
00000000C0F8  10     12      123456  4       5678    890     0       ACTIVE   1234567890   1

SQL> SELECT COUNT(*) FROM v$transaction WHERE status='ACTIVE';

  COUNT(*)
----------
         1
```

A
The transaction has been rolled back
Why wrong: Status is ACTIVE, not rolled back.
B
The transaction has been committed
Why wrong: Status is ACTIVE, not committed.
C
No transactions are currently active
Why wrong: The count shows 1 active transaction.
D
Exactly one transaction is currently active
The query returns one row with status ACTIVE.

Full breakdown with real-world context →

Question 12mediummultiple choice

Full question →

During a forensic investigation, the analyst runs netstat -ano on a compromised workstation. Based on the exhibit, which connection is MOST suspicious and should be investigated further?

Exhibit

Refer to the exhibit.

```
C:\>netstat -ano

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       1234
  TCP    192.168.1.10:49152     203.0.113.5:443        ESTABLISHED     5678
  TCP    192.168.1.10:49153     192.168.1.1:53         TIME_WAIT       0
  UDP    0.0.0.0:5353           *:*                                    910
  UDP    192.168.1.10:137       *:*                                    910
```

A
The established HTTPS connection to 203.0.113.5:443 (PID 5678).
203.0.113.5 is a test address and likely indicates a connection to a suspicious host.
B
The DNS query to 192.168.1.1:53 in TIME_WAIT state.
Why wrong: DNS queries are normal network activity.
C
The UDP listener on port 5353 (mDNS) with PID 910.
Why wrong: mDNS is used for local network discovery; not typically malicious.
D
The listening RDP service on port 3389 (PID 1234).
Why wrong: RDP is a common service; not inherently suspicious.

Full breakdown with real-world context →

Question 13mediummultiple choice

Full question →

Based on the exhibit, what is the most likely indication of malware persistence?

Exhibit

Refer to the exhibit.

C:\Users\Admin> sc query | findstr /i "service"
SERVICE_NAME: WinDefend
DISPLAY_NAME: Windows Defender Antivirus Service
STATE: 4 RUNNING

C:\Users\Admin> tasklist /svc
Image Name PID Services
================= ======== ============================================
svchost.exe 1234 WinDefend
svchost.exe 5678 BFE, MpsSvc
services.exe 4321 

C:\Users\Admin> netstat -ano | findstr :4444
  TCP    0.0.0.0:4444   0.0.0.0:0    LISTENING     4321

A
services.exe PID 4321 is a known malware process
Why wrong: services.exe is a legitimate system process; it's not inherently malware.
B
Windows Defender service is stopped, allowing malware to run
Why wrong: The exhibit shows Windows Defender is running (STATE: 4 RUNNING).
C
services.exe is listening on TCP port 4444, indicating possible code injection
services.exe should not have open listening ports; port 4444 is suspicious and suggests malware injected into the process.
D
svchost.exe hosting BFE and MpsSvc indicates a firewall bypass
Why wrong: BFE (Base Filtering Engine) and MpsSvc (Windows Firewall) are normal services.

Full breakdown with real-world context →

These CHFI practice questions are part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style CHFI questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Refer to the Exhibit Practice Questions

How to approach refer to the exhibit practice questions

Quick answer

Related CHFI topic practice pages

Computer Forensics Investigation Process practice questions

Computer Forensics Fundamentals and Process practice questions

Storage Forensics and File System Analysis practice questions

Incident Response and First Responder Skills practice questions

Computer Forensics Lab practice questions

Evidence Acquisition and Duplication practice questions

OS and Network Forensics practice questions

OS and File System Forensics practice questions

Application, Email and Cloud Forensics practice questions

Mobile and Malware Forensics practice questions

Network and Cloud Forensics practice questions

Database and Application Forensics practice questions

Practice scenarios

Refer to the exhibit. A first responder runs the netstat command on a compromised Windows workstation. Which of the following conclusions is BEST supported by the output?

Exhibit

Refer to the exhibit. The FTK Imager output shows a disk with an NTFS partition. The examiner notes that the $MFT mirror is at cluster 2. What is the logical size of the $MFT mirror in bytes?

Exhibit

Refer to the exhibit. During a malware investigation, a forensic analyst runs the commands shown. What is the most likely conclusion?

Exhibit

Based on the log exhibit, what type of attack is occurring?

Exhibit

Based on the ARP table exhibit, what is the most likely security issue?

Refer to the exhibit. An analyst recovers this binary log entry from a MySQL server. What does the timestamp '190101 10:00:00' represent?

Exhibit

During a malware investigation, an analyst discovers a suspicious file with a hash value that matches known malware. However, the file fails to execute and does not exhibit any malicious behavior in a sandbox. What is the most likely reason for this discrepancy?

Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?

Exhibit

Refer to the exhibit. A forensic examiner is analyzing a Windows system and sees the above NTFS file metadata. The user claims the file was last accessed at 09:15. Which of the following best explains the discrepancy?

Exhibit

Refer to the exhibit. An investigator runs the queries on an Oracle database during a live forensic acquisition. What does the output indicate about the database transaction state?

Exhibit

During a forensic investigation, the analyst runs netstat -ano on a compromised workstation. Based on the exhibit, which connection is MOST suspicious and should be investigated further?

Exhibit

Based on the exhibit, what is the most likely indication of malware persistence?

Exhibit