CHFI Practice Questions

Question 1

An investigator acquires an SSD from a laptop that has been turned off for 24 hours. The suspect recently deleted several incriminating files. Using a forensic imager, the investigator creates a bit-for-bit copy. However, when analyzing the image, the deleted files' data appears to be zeros. What is the MOST likely cause?

Accepted Answer

The TRIM command was issued, causing the SSD to erase the freed blocks. The TRIM command is an ATA command that allows an operating system to inform an SSD which data blocks are no longer in use and can be wiped internally. When the suspect deleted the files, the OS likely issued a TRIM command to the SSD, causing the controller to erase the freed physical blocks. Since the laptop was off for 24 hours, the SSD had ample time to complete the garbage collection process, resulting in the deleted files' data appearing as zeros in the forensic image.

Answer

The files were stored in the paging file, which is volatile

Answer

The SSD controller performed wear leveling, moving data to unallocated blocks

Answer

The imaging tool incorrectly interpreted the data due to encryption

Question 2

In email forensics, which TWO of the following headers are most useful for identifying the true origin of an email? (Select TWO.)

Accepted Answer

X-Originating-IP. Received headers show the path and each server's IP, while X-Originating-IP may contain the sender's IP. DKIM verifies integrity but not origin IP. Message-ID is just an identifier.

Answer

Message-ID

Answer

DKIM-Signature

Answer

MIME-Version

Question 3

A security team detects a suspicious process that writes to the Windows registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run. What is the MOST likely purpose of this activity?

Accepted Answer

Establishing persistence for malware. The Run key is a common auto-start location used for persistence. Writing to it ensures the process executes at user logon.

Answer

Clearing browser history

Answer

Updating system time

Answer

Configuring firewall rules

Question 4

A forensic lab manager is setting up a new lab and must decide on the physical security measures. Which of the following is the MOST important to implement first?

Accepted Answer

Implement a biometric access control system. Biometric access control is the most critical first step because it establishes a foundational layer of physical security that authenticates and authorizes personnel before they can access the lab. Without controlling who enters, other measures like CCTV or fire suppression are less effective, as unauthorized individuals could compromise evidence integrity. This aligns with the principle of defense-in-depth, where access control is the primary barrier against tampering or theft.

Answer

Construct Faraday cages around the evidence storage area

Answer

Deploy CCTV cameras covering all entry points

Answer

Install a gas-based fire suppression system

Question 5

Refer to the exhibit. During incident response, a first responder runs 'netstat -ano' on a compromised Windows system. Which connection is most likely to be the command-and-control (C2) channel and should be prioritized for isolation?

Accepted Answer

192.168.1.100:1045 to 203.0.113.5:4444 (ESTABLISHED). Shows an established connection from the internal host (192.168.1.100) to an external IP (203.0.113.5) on TCP port 4444, which is commonly associated with Metasploit reverse shells and other C2 frameworks. The ESTABLISHED state indicates an active, ongoing session, making it the highest priority for isolation during incident response.

Answer

192.168.1.100:1047 to 10.0.0.1:22 (ESTABLISHED)

Answer

192.168.1.100:1046 to 192.168.1.1:443 (ESTABLISHED)

Answer

192.168.1.100:1048 to 198.51.100.7:80 (TIME_WAIT)

Question 6

The command used to acquire a disk image resulted in an I/O error. What is the most likely cause?

Accepted Answer

The source disk has bad sectors. When a disk imaging tool (e.g., dd, FTK Imager, EnCase) encounters an I/O error during acquisition, the most common cause is physical damage or degradation of the source media, specifically bad sectors. Bad sectors prevent the read head from reliably retrieving data, triggering an I/O error at the operating system or device driver level. This is distinct from logical errors like file system corruption, which typically produce different error messages.

Answer

The output file already exists and is being overwritten

Answer

The target directory does not have write permissions

Answer

The target drive is full

Question 7

In cloud forensics, one of the major challenges is that data may be stored in multiple jurisdictions with different legal requirements. This challenge is known as:

Accepted Answer

Data jurisdiction. Data jurisdiction refers to the legal and regulatory issues that arise when data is stored or processed across different geographic locations with varying laws.

Answer

Multi-tenancy

Answer

Chain of custody

Answer

Volatile evidence

Question 8

Which cloud service log is most appropriate for tracking API calls and resource changes in an AWS environment?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity and resource changes.

Answer

AWS VPC Flow Logs

Answer

AWS Config

Answer

AWS CloudWatch Logs

Question 9

An investigator is analyzing cloud storage logs and finds an entry showing that a file was accessed using the root credentials from an IP address in a different geographic region. The organization has strict policies against root usage. What should the investigator do FIRST?

Accepted Answer

Check if the activity correlates with a known vulnerability or authorized task. The first step in any forensic investigation is to correlate the suspicious activity with known events, such as authorized tasks or vulnerabilities, to avoid false positives. Root access from an unfamiliar IP could be legitimate if tied to a scheduled maintenance window or a known vulnerability exploitation attempt that requires verification. Prematurely changing credentials or contacting law enforcement could destroy evidence or alert an attacker before the scope is understood.

Answer

Contact law enforcement for cybercrime investigation

Answer

Change the password of the root account

Answer

Immediately revoke the root access keys

Question 10

Which of the following is the PRIMARY purpose of using a write blocker in computer forensics?

Accepted Answer

To prevent any modification to the original evidence drive during acquisition.. A write blocker ensures that no data is written to the original evidence drive during acquisition, maintaining its integrity.

Answer

To speed up the imaging process by caching writes.

Answer

To convert the hard drive interface from SATA to USB.

Answer

To encrypt the forensic image for secure transport.

Question 11

During a cloud forensic investigation, an analyst needs to identify who deleted an S3 bucket in an AWS environment. Which AWS service log should the analyst examine to find the API call and the associated IAM user or role?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made to AWS services, including S3 bucket deletion, along with the identity of the caller.

Answer

Amazon S3 server access logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 12

A forensic investigator is analyzing a compromised web server. In the Apache access logs, the investigator finds the following request: 'GET /images/../../../etc/passwd HTTP/1.1' with a 200 status code. Which of the following is the MOST likely reason the server returned a 200 (OK) response?

Accepted Answer

The server is vulnerable to directory traversal and returned the contents of /etc/passwd. A 200 response to a path traversal request indicates that the server executed the request and returned the file content, meaning the directory traversal attack succeeded.

Answer

The server redirected the request to the root directory and returned the index page

Answer

The server has a custom 404 page that returns a 200 status code

Answer

The request was blocked by a web application firewall (WAF) which returned a 200 status

Question 13

A security analyst reviewing Apache access logs finds entries like: 192.168.1.10 - - [12/Jan/2023:15:23:11 +0000] "GET /search?q=1' OR '1'='1 HTTP/1.1" 200 5324. What attack is indicated?

Accepted Answer

SQL injection. The log entry shows a SQL injection attempt via the 'q' parameter with a tautology. The 200 response indicates the request was processed, suggesting possible success.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Command injection

Question 14

A CHFI analyst is called to investigate a suspected data breach. The IT team has already shut down the server. Which of the following is the most appropriate order of actions to preserve evidence?

Accepted Answer

Secure the scene, photograph the setup, document connections, remove hard drives, and create forensic images using a write-blocker.. It follows the established forensic investigation process: secure the scene to prevent contamination, document the state of the server (photographs and connection diagrams), then physically remove the hard drives and create forensic images using a write-blocker to preserve the original data without alteration. This ensures evidence integrity and admissibility in legal proceedings.

Answer

Immediately power on the server to check for running processes.

Answer

Copy all files from the server to an external USB drive.

Answer

Run antivirus scan to ensure no malware is present before imaging.

Question 15

Which of the following BEST defines the chain of custody in digital forensics?

Accepted Answer

The chronological documentation of evidence handling, transfer, and analysis. The chain of custody is a formal, chronological record that documents every instance of evidence handling, transfer, and analysis from the moment of seizure through its entire lifecycle. This documentation is critical to prove that evidence has not been tampered with, altered, or corrupted, thereby maintaining its admissibility in legal proceedings under rules such as Federal Rule of Evidence 901.

Answer

The legal authority required to seize evidence

Answer

The order in which forensic tools are applied to evidence

Answer

The physical security measures used to store evidence

Computer Hacking Forensic Investigator CHFI practice test

Three ways to study

Study CHFI by domain

Study CHFI by topic

Computer Forensics Investigation Process practice questions

Computer Forensics Fundamentals and Process practice questions

Application, Email and Cloud Forensics practice questions

Mobile and Malware Forensics practice questions

Network and Cloud Forensics practice questions

Storage Forensics and File System Analysis practice questions

Database and Application Forensics practice questions

Incident Response and First Responder Skills practice questions

Computer Forensics Lab practice questions

OS and Network Forensics practice questions

Malware Forensics practice questions

Evidence Acquisition and Duplication practice questions

Top CHFI questions

Computer Hacking Forensic Investigator CHFI practice questions