Courseiva

CHFI · topic practice

Mobile and Malware Forensics practice questions

Practise Computer Hacking Forensic Investigator CHFI Mobile and Malware Forensics practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security
20 questionsDomain: Mobile and Malware Forensics
Practice 10 questionsBrowse domain →

What the exam tests

What to know about Mobile and Malware Forensics

Mobile and Malware Forensics questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Mobile and Malware Forensics exam traps

  • ▸Answering from memory before reading the full scenario.
  • ▸Missing a constraint such as cost, availability, security, scope or command context.
  • ▸Choosing a broad answer when the question asks for the most specific fix.
  • ▸Ignoring why the wrong options are tempting.

Practice set

Mobile and Malware Forensics questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice
Read the full Mobile and Malware Forensics explanation →

During a mobile forensics investigation, an analyst needs to acquire data from an iPhone that cannot be bypassed via passcode. The device is locked, and the analyst has the passcode. Which acquisition method provides the MOST comprehensive data extraction?

Question 2mediummultiple choice
Read the full Mobile and Malware Forensics explanation →

A security analyst is reviewing output from a Cuckoo Sandbox analysis of a suspicious executable. The report shows that the process created a mutex named 'Global\GLOBAL_MUTEX_123' and modified the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\. Which behavioral indicator is MOST evident?

Question 3hardmultiple choice
Read the full Mobile and Malware Forensics explanation →

In an Android forensic investigation, an examiner extracts the /data/data/com.whatsapp/databases/msgstore.db file. The database contains a table 'messages' with columns 'key_remote_jid', 'data', and 'timestamp'. Which SQL query would retrieve all messages sent to a specific contact with a phone number ending in '1234'?

Question 4easymultiple choice
Read the full Mobile and Malware Forensics explanation →

A forensic analyst is examining a Windows malware sample using static analysis. Which tool is BEST suited for viewing the PE header structure, including sections, imports, and exports?

Question 5mediummultiple choice
Read the full NAT/PAT explanation →

During an iOS forensic examination, an analyst extracts an iTunes backup and finds the file '3d0d7e5fb2ce288813306e4d4636395e047a3d28'. Which type of data does this file typically contain?

Question 6mediummultiple choice
Read the full Mobile and Malware Forensics explanation →

A forensic examiner is analyzing an Android device that has been factory reset. Which artefact is MOST likely to persist after a factory reset, providing potential evidence of prior usage?

Question 7hardmultiple choice
Read the full NAT/PAT explanation →

An analyst runs 'regshot' before and after executing a suspicious binary. The report shows that the binary added a value to HKLM\SYSTEM\CurrentControlSet\Services\MyService with 'ImagePath' pointing to C:\Windows\system32\malware.exe and 'Start' set to 2. What is the MOST likely purpose?

Question 8mediummultiple choice
Read the full Mobile and Malware Forensics explanation →

A malware analyst uses Cuckoo Sandbox to analyze a sample. The report shows that the sample sends HTTP POST requests to 'http://malicious.example.com/gate.php' with encrypted data. Which type of indicator of compromise (IoC) is this?

Question 9easymultiple choice
Read the full Mobile and Malware Forensics explanation →

Which mobile forensics tool is specifically designed for physical extraction of iOS devices, including bypassing passcodes and extracting full file system images?

Question 10mediummultiple choice
Read the full Mobile and Malware Forensics explanation →

During dynamic analysis of a malware sample, an analyst uses Process Monitor to capture registry and file system activity. Which filter would be MOST effective in identifying attempts to create a persistence mechanism?

Question 11hardmultiple choice
Read the full Mobile and Malware Forensics explanation →

An iOS forensic analyst extracts the Keychain from an iTunes backup. Within the Keychain, they find an entry with class 'Generic Password', service 'com.apple.sbd', and account 'iCloud'. What type of data does this entry MOST likely contain?

Question 12mediummultiple choice
Read the full Mobile and Malware Forensics explanation →

A security analyst detects that a system's 'SeDebugPrivilege' is enabled for a suspicious process. Which technique is the malware MOST likely attempting to use?

Question 13mediummulti select
Read the full Mobile and Malware Forensics explanation →

A forensic examiner is analyzing a mobile device that may have been tampered with to erase evidence. Which TWO anti-forensic techniques are commonly encountered in mobile forensics? (Select TWO.)

Question 14hardmulti select
Read the full Mobile and Malware Forensics explanation →

A malware analyst is performing static analysis on a packed executable. Which THREE techniques are effective for unpacking or analyzing packed malware? (Select THREE.)

Question 15mediummulti select
Read the full Mobile and Malware Forensics explanation →

An analyst is investigating a potential data breach on an Android device. Which TWO artefacts are MOST useful for determining which third-party apps were installed and used? (Select TWO.)

Question 16mediummultiple choice
Read the full NAT/PAT explanation →

During an iOS forensic examination, an analyst extracts an iTunes backup and finds a file named 'SMS.db'. Which of the following tools is BEST suited to parse and analyze this SQLite database for SMS and iMessage content?

Question 17hardmultiple choice
Read the full Mobile and Malware Forensics explanation →

A security analyst runs a dynamic analysis of a suspected malware sample using Cuckoo Sandbox. The report shows that the sample created a mutex named 'Global\MyMaliciousMutex', added a registry run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, and attempted to communicate with an IP address 185.10.68.12 on port 443. Which of the following is the BEST immediate indicator of compromise (IoC) to share with the threat intelligence team?

Question 18easymultiple choice
Read the full Mobile and Malware Forensics explanation →

In Android forensics, which of the following acquisition methods provides the most complete and forensically sound image of the device's internal storage?

Question 19mediummultiple choice
Read the full Mobile and Malware Forensics explanation →

During a malware analysis session, an analyst uses Process Monitor (Procmon) to observe a suspicious executable. Which of the following behavioral indicators would MOST strongly suggest the malware is attempting to establish persistence?

Question 20mediummultiple choice
Read the full Mobile and Malware Forensics explanation →

An iOS forensic analyst is examining data from an iCloud backup and finds a file named 'call_history.db'. Which SQLite table within this database is MOST likely to contain the duration and timestamp of each phone call?

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Sign up freeLog in

Focused Mobile and Malware Forensics sessions

Start a Mobile and Malware Forensics only practice session

Every question in these sessions is drawn from the Mobile and Malware Forensics domain — nothing else.

10 questions20 questions30 questions50 questions
Browse all Mobile and Malware Forensics questions →Mixed CHFI session

Related practice questions

Related CHFI topic practice pages

Move into related areas when this topic feels solid.

Computer Forensics Investigation Process practice questions

Practise CHFI questions linked to Computer Forensics Investigation Process.

Computer Forensics Fundamentals and Process practice questions

Practise CHFI questions linked to Computer Forensics Fundamentals and Process.

Storage Forensics and File System Analysis practice questions

Practise CHFI questions linked to Storage Forensics and File System Analysis.

Incident Response and First Responder Skills practice questions

Practise CHFI questions linked to Incident Response and First Responder Skills.

Computer Forensics Lab practice questions

Practise CHFI questions linked to Computer Forensics Lab.

Evidence Acquisition and Duplication practice questions

Practise CHFI questions linked to Evidence Acquisition and Duplication.

OS and Network Forensics practice questions

Practise CHFI questions linked to OS and Network Forensics.

OS and File System Forensics practice questions

Practise CHFI questions linked to OS and File System Forensics.

Application, Email and Cloud Forensics practice questions

Practise CHFI questions linked to Application, Email and Cloud Forensics.

Mobile and Malware Forensics practice questions

Practise CHFI questions linked to Mobile and Malware Forensics.

Network and Cloud Forensics practice questions

Practise CHFI questions linked to Network and Cloud Forensics.

Database and Application Forensics practice questions

Practise CHFI questions linked to Database and Application Forensics.

Frequently asked questions

What does the CHFI exam test about Mobile and Malware Forensics?
Mobile and Malware Forensics questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?
Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Mobile and Malware Forensics questions in a focused session?
Yes — the session launcher on this page draws every question from the Mobile and Malware Forensics domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CHFI topics?
Use the topic links above to move to related areas, or go back to the CHFI question bank to see all topics.
Are these real exam questions or dumps?
These are original practice questions written to test the same concepts the CHFI exam covers. They are not copied from any real exam or dump site.