Free EC-Council 312-49v11 CHFI v11 Practice Questions

Question 1

A suspect is accused of violating the acceptable use of computing resources, as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared the search history and emptied the cookie cache. Moreover, he has removed any images he might have downloaded.

What can the investigator do to prove the violation?

1. Image the disk and try to recover deleted files
2. Seek the help of co-workers who are eye-witnesses
3. Check the Windows registry for connection data (you may or may not recover)
4. Approach the website's administrator for evidence

Question 2

You have been asked to investigate the possibility of computer fraud in the finance department of a company. It is suspected that a staff member has been committing finance fraud by printing cheques that have not been authorized. You have exhaustively searched all data files on a bitmap image of the target computer, but have found no evidence. You suspect the files may not have been saved.

What should you examine next in this case?

1. The registry
2. The swap file
3. The recycle bin
4. The metadata

Question 3

Which of the following are small pieces of data sent from a website and stored on the user’s computer by the user’s web browser to track, validate, and maintain specific user information?

1. Temporary Files
2. Open files
3. Cookies
4. Web Browser Cache

Question 4

Depending upon the jurisdictional areas, different laws apply to different incidents.

Which of the following law is related to fraud and related activity in connection with computers?

1. 18 USC §1029
2. 18 USC §1030
3. 18 USC §1361
4. 18 USC §1371

Question 5

Charles has accidentally deleted an important file while working on his Mac computer. He wants to recover the deleted file as it contains some of his crucial business secrets.

Which of the following tool will help Charles?

1. Xplico
2. Colasoft’s Capsa
3. FileSalvage
4. DriveSpy

Question 6

Jason discovered a file named $RIYG6VR.doc in the C:\$Recycle.Bin\<USER SID>\ while analyzing a hard disk image for the deleted data.

What inferences can he make from the file name?

1. It is a doc file deleted in seventh sequential order
2. RIYG6VR.doc is the name of the doc file deleted from the system
3. It is a file deleted from R drive
4. It is a deleted doc file

Question 7

Which of the following attacks allows an attacker to access restricted directories, including application source code, configuration and critical system files, and to execute commands outside of the web server’s root directory?

1. Parameter/form tampering
2. Unvalidated input
3. Directory traversal
4. Security misconfiguration

Question 8

Annie is searching for certain deleted files on a system running Windows XP OS.

Where will she find the files if they were not completely deleted from the system?

1. C:\$Recycled.Bin
2. C:\$Recycle.Bin
3. C:\RECYCLER
4. C:\$RECYCLER

Question 9

Which of the following files stores information about a local Google Drive installation such as User email ID, Local Sync Root Path, and Client version installed?

1. filecache.db
2. config.db
3. sigstore.db
4. Sync_config.db

Question 10

What do you call the process of studying the changes that have taken place across a system or a machine after a series of actions or incidents?

1. Windows Services Monitoring
2. System Baselining
3. Start-up Programs Monitoring
4. Host integrity Monitoring

Question 11

As an experienced forensic analyst, you’ve been called upon to examine a Linux server suspected of being compromised. You are performing file system analysis using The Sleuth Kit (TSK) to discover any anomalies. While conducting the analysis, you notice that there’s a huge amount of data and manually checking each file would be impractical.

What feature of TSK should you use to automate the process and identify potential evidence more effectively?

1. Disk imaging
2. File system timeline
3. Hash database lookup
4. File carving

Question 12

Consider a scenario where a forensic investigator is performing malware analysis on a memory dump acquired from a victim's computer. The investigator uses Volatility Framework to analyze RAM contents: which plugin helps investigator to identify hidden processes or injected code/DLL in the memory dump?

1. malfind
2. pslist
3. mallist
4. malscan

Question 13

An investigator is examining a file to identify any potentially malicious content. To avoid code execution and still be able to uncover hidden indicators of compromise (IOC), which type of examination should the investigator perform:

1. Dynamic analysis
2. Threat hunting
3. Threat analysis
4. Static analysis

Question 14

Amber, a black hat hacker, has embedded a malware into a small enticing advertisement and posted it on a popular ad-network that displays across various websites.

What is she doing?

1. Click-jacking
2. Compromising a legitimate site
3. Spearphishing
4. Malvertising

Question 15

A company is conducting a large-scale eDiscovery process to gather, process, and produce data relevant to an ongoing investigation. The legal and IT teams are tasked with monitoring the progress of these stages to ensure data integrity and accuracy. They also need to manage the associated costs effectively throughout the process. Given the complexity and scale of the eDiscovery process, proper tracking is essential.

Which aspect should the company prioritize to achieve these objectives?

1. Implement a centralized data repository to streamline access and management of the gathered electronic evidence.
2. Develop a comprehensive training program for staff involved in the eDiscovery process.
3. Define key performance indicators (KPIs) and measure the volume of information at every stage of the eDiscovery process.
4. Establish a cross-functional team to oversee the coordination between legal and IT departments during the eDiscovery process.

Question 16

An investigator wants to extract passwords from SAM and System Files.

Which tool can the investigator use to obtain a list of users, passwords, and their hashes in this case?

1. Nuix
2. FileMerlin
3. PWdump7
4. HashKey

Question 17

During an investigation, the first responders stored mobile devices in specific containers to provide network isolation. All the following are examples of such pieces of equipment, except for:

1. Faraday bag
2. VirtualBox
3. Wireless StrongHold bag
4. RF shield box

Question 18

Working as an investigator at a digital forensic firm, Mike has been handed a case involving a Windows computer suspected of being used for illegal activities. Mike has been tasked with examining the metadata of numerous files to look for any signs of illicit activity. He is considering various tools including FTK Imager, OSForensics, ExifTool, and EnCase.

Which tool should Mike select for his specific requirement of analyzing file metadata?

1. ExifTool
2. OSForensics
3. EnCase
4. FTK Imager

Question 19

Chris, a digital forensics expert, is investigating a compromised Windows system using the BIOS-MBR boot method. Upon reviewing the system’s boot process, he confirms that the Power-On Self-Test (POST) has successfully completed. The BIOS has checked the hardware and verified the integrity of essential system components like the CPU, memory, and storage devices. After this, the BIOS loads the Master Boot Record (MBR) from the bootable device.

At this point in the process, the system’s boot manager is expected to take over. The boot manager, located on the MBR, is responsible for locating and triggering the appropriate boot loader. Chris knows that the boot manager will locate a system file that is integral for starting the Windows operating system. This next step involves loading a critical system file that helps the OS load into memory.

Given that the system is using the BIOS-MBR method, Chris knows that after the BIOS completes POST and the MBR is loaded, the next task is the loading of this essential file, which is key to the boot process.

What should Chris expect to happen next in the boot sequence?

1. The system loads Winload.exe
2. The system initializes HAL.dll
3. The system runs a kernel integrity check
4. The system passes control to Winlogon.exe

Question 20

Which of these Windows utility help you to repair logical file system errors?

1. Resource Monitor
2. Disk cleanup
3. Disk defragmenter
4. CHKDSK

Question 21

An attacker successfully gained access to a remote Windows system and plans to install persistent backdoors on it. Before that, to avoid getting detected in future, he wants to cover his tracks by disabling the last-accessed timestamps of the machine.

What would he do to achieve this?

1. Set the registry value of HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate to 0
2. Run the command fsutil behavior set disablelastaccess 0
3. Set the registry value of HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate to 1
4. Run the command fsutil behavior set enablelastaccess 0

Question 22

An investigator is assigned to a complex cybercrime case involving unauthorized access to sensitive and confidential data stored on a corporate server. The investigation is being conducted in a jurisdiction with strict privacy laws and digital evidence guidelines, while the suspect is located in a different jurisdiction that adheres to its own set of privacy and evidence laws. The investigator must gather and preserve evidence from the suspect’s devices using specialized digital forensic tools. However, the investigator faces significant challenges as they navigate the differing legal frameworks that govern the collection and handling of digital evidence across the two jurisdictions.

As part of the investigation, the investigator uses forensic tools to create forensic images of the suspect’s devices and to gather data from the breached systems. Due to the differences in legal requirements, the investigator is unsure of how to ensure compliance with both jurisdictions’ laws while maintaining the integrity of the evidence.

Which legal challenge might the investigator face in this case when handling the evidence?

1. The challenge of using outdated forensic tools that are not compatible with newer file systems and devices.
2. The requirement to use the same forensic tool across all devices involved to ensure uniformity in evidence handling.
3. The need for forensic tools to have encryption capabilities to secure the evidence during transport.
4. The need to ensure that the forensic tools used during the investigation are validated according to the regulations of both regions involved.

Question 23

In Java, when multiple applications are launched, multiple Dalvik Virtual Machine instances occur that consume memory and time. To avoid that, Android implements a process that enables low memory consumption and quick start-up time.

What is the process called?

1. Init
2. Zygote
3. Daemon
4. Media server

Question 24

An investigator has been assigned to analyze network activity and user interactions on a corporate IIS web server after a suspected security breach. The task requires the investigator to process large volumes of IIS log data, focusing on identifying suspicious traffic trends, user access, and potential exploitation attempts. The tool used must allow for efficient log parsing, anomaly detection, and the generation of detailed reports to help reconstruct the event timeline. Given these requirements, which tool should the investigator choose to analyze the IIS logs effectively?

1. Sawmill
2. DSInternals PowerShell
3. Jatheon
4. Hunchly

Question 25

Jackson, a seasoned mobile forensics investigator, is tasked with analyzing an iPhone that may contain critical evidence for an ongoing investigation. He is under a tight deadline and cannot afford to interact with any user data or bypass the device’s security features through conventional means such as passcode entry. Jackson needs to retrieve essential system-level information from the device for forensic analysis, such as the device’s IMEI number, serial number, and other hardware details. He also needs to ensure that no user data is compromised or exposed during the analysis.

Which mode should Jackson utilize to gain access to the required information while adhering to forensic standards?

1. Safe Mode
2. Recovery Mode
3. DFU Mode
4. Jailbreak Mode

Question 26

Netstat is a tool for collecting information regarding network connections. It provides a simple view of TCP and UDP connections, and their state and network traffic statistics.

Which of the following commands shows you the TCP and UDP network connections, listening ports, and the identifiers?

1. netstat -r
2. netstat -ano
3. netstat -b
4. netstat -s

Question 27

_____________ allows a forensic investigator to identify the missing links during investigation.

1. Chain of custody
2. Exhibit numbering
3. Evidence preservation
4. Evidence reconstruction

Question 28

Which layer in the IoT architecture is comprised of hardware parts such as sensors, RFID tags, and devices that play an important role in data collection?

1. Access gateway layer
2. Application layer
3. Edge technology layer
4. Middleware layer

Question 29

A company’s online banking platform has recently been experiencing security breaches, with unauthorized access to customer accounts. Upon investigation, it is suspected that a brute force attack is being employed to gain entry.

In the scenario described, what does the term “brute force attack” likely refer to?

1. An attack where hackers manipulate user interface elements to gain access to sensitive data.
2. A social engineering tactic involving tricking employees into revealing login credentials.
3. A method of exploiting vulnerabilities in the company’s network infrastructure.
4. A technique where attackers systematically guess passwords or encryption keys to gain unauthorized access.

Question 30

A breach resulted from a malware attack that evaded detection and compromised the machine memory without installing any software or accessing the hard drive.

What technique did the adversaries use to deliver the attack?

1. Trojan
2. JavaScript
3. Spyware
4. Fileless

Question 31

A cybersecurity analyst at a leading technology firm has discovered a suspicious file in the company’s network. Concerned that it may be malware, the analyst decides to conduct both static and dynamic analysis to assess the potential threat posed by the file.

In the scenario described, what would be the primary purpose of conducting static analysis on the suspicious file?

1. To execute the file in a controlled environment to observe its behavior.
2. To manually reverse-engineer the code to understand the functionality of the file.
3. To gather initial information about the file’s behavior through dynamic execution.
4. To analyze the code of the file without running it to identify potential security threats.

Question 32

Which "Standards and Criteria" under SWGDE states that "the agency must use hardware and software that are appropriate and effective for the seizure or examination procedure"?

1. Standards and Criteria 1.4
2. Standards and Criteria 1.5
3. Standards and Criteria 1.6
4. Standards and Criteria 1.7

Question 33

An organization is preparing to establish an in-house eDiscovery team to handle the identification, collection, and preservation of electronic evidence for a cybercrime investigation. This team is comprised of experts from both the legal and IT departments, ensuring that the process is not only efficient but also fully compliant with legal standards. The legal team is tasked with defining the specific scenarios, protocols, and legal guidelines under which evidence can be collected, ensuring that the entire process aligns with legal frameworks and requirements. Meanwhile, the IT team is responsible for managing the technical aspects of the collection process, ensuring that evidence is gathered in a secure and forensically sound manner, avoiding any risk of data alteration or loss. By bringing together both legal and IT professionals, the organization can ensure that both the technical and legal facets of eDiscovery are handled appropriately.

What is the primary benefit of involving both legal and IT teams in the eDiscovery process?

1. The legal team focuses on technical issues during evidence collection, while the IT team provides legal guidance.
2. Both teams are responsible for the initial analysis of evidence, with the IT team focusing on hardware and the legal team on case review.
3. The IT team is solely responsible for ensuring the proper collection of evidence, while the legal team focuses only on documentation.
4. The IT team ensures the integrity of collected evidence, while the legal team ensures its admissibility in court.

Question 34

An international airline recently discovered a cyber intrusion in their reservation system. The breach was intricately planned and executed, leaving very few traces behind. The threat actors utilized sophisticated anti-forensics techniques, including data obfuscation and log manipulation, making it challenging for the internal cybersecurity team to trace the attack’s origin and understand its full impact. Faced with this complicated investigation, which of the following should be the first course of action for the cybersecurity team?

1. Reverse engineer the methods employed by the threat actors.
2. Roll out system updates across all devices to patch any potential vulnerabilities.
3. Focus on identifying the exact data that has been compromised.
4. Implement strict access controls across all the systems.

Question 35

You are asked to build a forensic lab and your manager has specifically informed you to use copper for lining the walls, ceilings, and floor.

What is the main purpose of lining the walls, ceilings, and floor with copper?

1. To control the room temperature
2. To strengthen the walls, ceilings, and floor
3. To avoid electromagnetic emanations
4. To make the lab sound proof

Question 36

Which following forensic tool allows investigator to detect and extract hidden streams on NTFS drive?

1. Autopsy
2. TimeStomp
3. analyzeMFT
4. Stream Detector

Question 37

On the heels of a massive coordinated cyberattack, a multinational corporation called upon the services of veteran forensic investigator, Lisa. The attack infiltrated their MSSQL servers, and Lisa suspected the breach was a result of a sophisticated SQL Injection method that was executed from multiple sources and locations simultaneously. To determine the attack’s origin, Lisa needs to not only collect but also examine the evidence files on the MSSQL server. To cope with the breach’s scale and sophistication, which tool should Lisa rely on?

1. Nessus
2. EnCase
3. SQLsus
4. Sqlmap

Question 38

Jacob, a cybercrime investigator, joined a forensics team to participate in a criminal case involving digital evidence. After the investigator collected all the evidence and presents it to the court, the judge dropped the case and the defense attorney pressed charges against Jacob and the rest of the forensics team for unlawful search and seizure.

What forensics privacy issue was not addressed prior to collecting the evidence?

1. Compliance with the Third Amendment of the U.S. Constitution
2. None of these
3. Compliance with the Second Amendment of the U.S. Constitution
4. Compliance with the Fourth Amendment of the U.S. Constitution

Question 39

Which of the following statements is true regarding SMTP Server?

1. SMTP Server breaks the recipient’s address into Recipient’s name and his/her designation before passing it to the DNS Server
2. SMTP Server breaks the recipient's address into Recipient’s name and recipient’s address before passing it to the DNS Server
3. SMTP Server breaks the recipient’s address into Recipient’s name and domain name before passing it to the DNS Server
4. SMTP Server breaks the recipient’s address into Recipient’s name and his/her initial before passing it to the DNS Server

Question 40

William, a forensic specialist, was assigned to investigate a system breach by extracting artifacts related to the Tor browser from a memory dump obtained from the victim’s machine. As part of the investigation, William analyzed the memory dump and discovered that it contained the maximum possible number of artifacts related to the Tor browser. William understood that to fully understand the extent of the evidence, he needed to identify which condition would result in the maximum number of artifacts being present in the memory dump.

Which of the following conditions provided William with the maximum possible number of artifacts?

1. Tor browser closed
2. Tor browser opened
3. Tor browser installed
4. Tor browser uninstalled

Question 41

An investigator is assigned to review dark web chat room communications as part of an ongoing cybercrime investigation. The chat logs span several weeks, consisting of a vast number of conversations filled with obscured language, coded references, and misleading statements designed to evade detection. Sifting through this extensive volume of messages to extract meaningful intelligence becomes an incredibly time-consuming and labor-intensive task, requiring advanced analysis tools and a systematic approach to filter out the noise and focus on the crucial details.

Which dark web forensics challenge does this scenario highlight?

1. The legal challenges in gathering evidence from global, anonymous platforms like the dark web.
2. The challenge of processing extensive chat room communications that contain obfuscated content.
3. The challenge of correlating chat room communications with real-world identities.
4. The difficulty in distinguishing between genuine and deceptive chat room communications.

Question 42

As a Computer Hacking Forensic Investigator, you’re working on a case involving the unauthorized alteration of financial records within a major bank. The network administrators have identified a specific terminal where they believe the alterations originated. You have been tasked with examining this workstation. The administrators inform you that the machine has been powered down for fear of further alterations. In this scenario, which of the following would be your first step?

1. Leave the system powered down, and initiate the forensic imaging process for further offline analysis.
2. Power up the machine and perform a live analysis to identify any running processes that might have been involved in the unauthorized alterations.
3. Connect the machine to a separate network and use a network packet analyzer to monitor any ongoing traffic.
4. Create a bootable copy of the hard drive to analyze on a separate, secure machine.

Question 43

The information security manager at a national legal firm has received several alerts from the intrusion detection system that a known attack signature was detected against the organization's file server.

What should the information security manager do first?

1. Disconnect the file server from the network
2. Update the anti-virus definitions on the file server
3. Report the incident to senior management
4. Manually investigate to verify that an incident has occurred

Question 44

Before accessing digital evidence from victims, witnesses, or suspects, on their electronic devices, what should the investigator do first to respect legal privacy requirements?

1. Protect the device against external communication
2. Remove the battery or turn-off the device
3. Notify the fact to the local authority or employer
4. Obtain a formal written consent to search

Question 45

A Linux system is undergoing investigation. In which directory should the investigators look for its current state data if the system is in powered on state?

1. /auth
2. /proc
3. /var/log/debug
4. /var/spool/cron/

Question 46

This law sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have you stop emailing them, and spells out tough penalties for violations.

1. European Anti-Spam act
2. Federal Spam act
3. The CAN-SPAM act
4. Telemarketing act

Question 47

In a multinational corporation, there have been increasing reports of system crashes and data leaks from the intranet. Forensic investigators discovered a highly polymorphic worm propagating across the network. The worm quickly changes its structure, making it difficult to analyze its behavior and create signatures. Susan, a cybersecurity analyst, needs to conduct a behavioral analysis of the worm in a secure and controlled environment.

Which of the following tools should she use for this purpose?

1. IDA Pro
2. Wireshark
3. Process Monitor
4. Cuckoo Sandbox

Question 48

As a forensic analyst in a cybersecurity firm, you’ve been tasked with investigating a breach at a client’s office. The breach involves multiple servers, each having its own set of logs and events. To make the analysis more efficient and identify the root cause of the breach, which type of event correlation should you employ?

1. Time-based correlation
2. Log-based correlation
3. Alert-based correlation
4. Rule-based correlation

Question 49

An investigator is conducting a forensic analysis on a suspect’s Microsoft Outlook account. The investigator identifies that the suspect’s emails are stored in both .pst (Personal Storage Table) and .ost (Offline Storage Table) files. Since the .ost file is primarily used for offline access to emails in IMAP, Exchange, or Outlook.com accounts, the investigator needs to decide on the appropriate method for acquiring and analyzing the data contained in these files. The investigator is particularly focused on analyzing the .ost file for email evidence.

Which of the following steps should the investigator take to properly acquire the email data from the .ost file?

1. Convert the .ost file to a .pst file using Kernel for OST to PST or similar tools.
2. Open the .ost file with a text editor to view the raw data.
3. Only analyze the .pst file, as the .ost file is not used for email storage.
4. Directly extract the email messages from the .ost file using SysTools MailPro+.

Question 50

When investigating a system, the forensics analyst discovers that malicious scripts were injected into benign and trusted websites. The attacker used a web application to send malicious code, in the form of a browser side script, to a different end-user.

What attack was performed here?

1. SQL injection attack
2. Cookie poisoning attack
3. Cross-site scripting attack
4. Brute-force attack

Question 51

Which part of Metasploit framework helps users to hide the data related to a previously deleted file or currently unused by the allocated file.

1. Waffen FS
2. RuneFS
3. FragFS
4. Slacker

Question 52

Storage location of Recycle Bin for NTFS file systems (Windows Vista and later) is located at:

1. Drive:\RECYCLE.BIN
2. Drive:\$Recycle.Bin
3. Drive:\REYCLED
4. Drive:\RECYCLER

Question 53

James, a hacker, identifies a vulnerability in a website. To exploit the vulnerability, he visits the login page and notes down the session ID that is created. He appends this session ID to the login URL and shares the link with a victim. Once the victim logs into the website using the shared URL, James reloads the webpage (containing the URL with the session ID appended) and now, he can browse the active session of the victim.

Which attack did James successfully execute?

1. Cross Site Request Forgery
2. Cookie Tampering
3. Parameter Tampering
4. Session Fixation Attack

Question 54

During a forensic investigation into a recent cyberattack, analysts discovered a piece of malware that had been deliberately disguised to avoid detection. The malware was wrapped in a layer of encryption, making its contents unreadable to typical security software. Once the layer was removed using decryption techniques, the true malicious functionality of the malware became visible.

Which of the following components is most likely responsible for this obfuscation?

1. Packer
2. Exploit
3. Payload
4. Dropper

Question 55

Event correlation is the process of finding relevance between the events that produce a final result.

What type of correlation will help an organization to correlate events across a set of servers, systems, routers and network?

1. Same-platform correlation
2. Network-platform correlation
3. Cross-platform correlation
4. Multiple-platform correlation

Question 56

During a forensic investigation, an examiner is analyzing a bitmap (BMP) image file. Upon examining the file structure, the examiner notices the first section of the file contains key information about the file type, its overall size, and how the data is arranged.

What is the name of this data structure?

1. RGBQUAD array
2. File header
3. Image data
4. Information header

Question 57

To understand the impact of a malicious program after the booting process and to collect recent information from the disk partition, an investigator should evaluate the content of the:

1. GRUB
2. UEFI
3. MBR
4. BIOS

Question 58

Web browsers can store relevant information from user activities. Forensic investigators may retrieve files, lists, access history, cookies, among other digital footprints.

Which tool can contribute to this task?

1. MZCacheView
2. Google Chrome Recovery Utility
3. Task Manager
4. Most Recently Used (MRU) list

Question 59

"To ensure that the digital evidence is collected, preserved, examined, or transferred in a manner safeguarding the accuracy and reliability of the evidence, law enforcement, and forensics organizations must establish and maintain an effective quality system" is a principle established by:

1. SWGDE
2. EC-Council
3. NIST
4. NCIS

Question 60

Data density of a disk drive is calculated by using _________.

1. Track density, areal density, and bit density.
2. Track space, bit area, and slack space.
3. Slack space, bit density, and slack density.
4. Track density, areal density, and slack density.

Question 61

To which phase of the Computer Forensics Investigation Process does the Planning and Budgeting of a Forensics Lab belong?

1. Post-investigation Phase
2. Reporting Phase
3. Pre-investigation Phase
4. Investigation Phase

Question 62

Which among the following is an act passed by the U.S. Congress in 2002 to protect investors from the possibility of fraudulent accounting activities by corporations?

1. HIPAA
2. GLBA
3. SOX
4. FISMA

Question 63

An organization has successfully defined its eDiscovery strategy, focusing on managing data collection efficiently for a legal investigation. As part of this strategy, the legal team is tasked with ensuring that only the relevant data is gathered from the appropriate sources. The legal team is responsible for identifying the data sources that contain electronically stored information (ESI) necessary for the investigation.

Which best practice for eDiscovery is the legal team following in this case?

1. Rely on self-collection by custodians without providing clear guidelines.
2. Map the data to identify custodians and determine the location of the data for collection.
3. Use directed collection to obtain all available data from custodians, including irrelevant files.
4. Collect data only from one source to minimize collection time and resources.

Question 64

Which of the following methods of mobile device data acquisition captures all the data present on the device, as well as all deleted data and access to unallocated space?

1. Direct acquisition
2. Physical acquisition
3. Logical acquisition
4. Manual acquisition

Question 65

Identify the location of Recycle Bin on a Windows 7 machine that uses NTFS file system to store and retrieve files on the hard disk.

1. Drive:\RECYCLER
2. Drive:\RECYCLED
3. Drive:\$Recycle.Bin
4. C:\RECYCLED

Question 66

Which of the following directory contains the binary files or executables required for system maintenance and administrative tasks on a Linux system?

1. /lib
2. /bin
3. /usr
4. /sbin

Question 67

Malware analysis can be conducted in various manners. An investigator gathers a suspicious executable file and uploads it to VirusTotal in order to confirm whether the file is malicious, provide information about its functionality, and provide information that will allow to produce simple network signatures.

What type of malware analysis was performed here?

1. Hybrid
2. Static
3. Volatile
4. Dynamic

Question 68

A forensic examiner encounters a computer with a failed OS installation and the master boot record (MBR) or partition sector damaged.

Which of the following tools can find and restore files and information in the disk?

1. NetCat
2. Helix
3. R-Studio
4. Wireshark

Question 69

Cloud forensic investigations impose challenges related to multi-jurisdiction and multi-tenancy aspects. To have a better understanding of the roles and responsibilities between the cloud service provider (CSP) and the client, which document should the forensic investigator review?

1. National and local regulation
2. Service level agreement
3. Key performance indicator
4. Service level management

Question 70

Adam is thinking of establishing a hospital in the US and approaches John, a software developer to build a site and host it for him on one of the servers, which would be used to store patient health records. He has learned from his legal advisors that he needs to have the server's log data reviewed and managed according to certain standards and regulations.

Which of the following regulations are the legal advisors referring to?

1. Health Insurance Portability and Accountability Act of 1996 (HIPAA)
2. Payment Card Industry Data Security Standard (PCI DSS)
3. Data Protection Act of 2018
4. Electronic Communications Privacy Act

Question 71

Megan, a CHFI investigator, is examining a complicated breach at a cutting-edge IoT technology company that designs systems for smart homes.

The company’s IoT devices have experienced a massive scale breach, with numerous devices sending unauthorized data to an external server. The company uses a public cloud-based model to manage IoT devices. The unique problem Megan faces is that the breach did not occur via the traditional IoT vulnerabilities as the devices have been designed with state-of-the-art security features and yet the attacker has managed to bypass all security measures.

Which of the following is the most plausible method the attacker could have used to compromise the IoT devices?

1. Used a botnet to flood the network with traffic
2. Manipulated the Cloud API to gain unauthorized access
3. Exploited weak encryption protocols in the company’s IoT devices
4. Hacked into the TOR Bridge Node used by the company

Question 72

In a large multinational organization, an advanced persistent threat (APT) has been detected. One of the Linux servers of the company seems to be communicating with a known malicious IP address. Alice, a cybersecurity analyst, has been given the task to analyze the situation. She collects volatile information from the server to examine active network connections and running processes. Alice is confused between three options: Redline, Volatility, and Rekall.

Which tool should Alice use to perform the analysis most effectively?

1. Redline
2. Volatility
3. Rekall
4. OSForensics

Question 73

You are the leading forensic analyst at a digital forensic firm. One of your significant clients, a government agency, has suffered a security breach resulting in an unauthorized leak of classified documents. Initial investigations have shown that the attacker, suspected to be an employee, used an anonymous, encrypted email service to send these documents to multiple unknown recipients. As part of your investigation, you have obtained disk images from the suspect’s workstation. Your task is to extract and analyze the relevant evidence that could lead to identifying the unknown recipients.

What should be your first step?

1. Review the disk image for any signs of a trojan or other malware that could have been used in the data breach.
2. Analyze internet history files for potential traces of the anonymous, encrypted email service.
3. Execute a full search of the disk image for file artifacts related to the anonymous, encrypted email service.
4. Inspect the email client on the disk image for any unencrypted data that could contain the recipient’s information.

Question 74

Examination of a computer by a technically unauthorized person will almost always result in:

1. Rendering any evidence found inadmissible in a court of law
2. Completely accurate results of the examination
3. The chain of custody being fully maintained
4. Rendering any evidence found admissible in a court of law

Question 75

An investigator is checking a Cisco firewall log that reads as follows:

Aug 21 2019 09:16:44: %ASA-1-106021: Deny ICMP reverse path check from 10.0.0.44 to 10.0.0.33 on interface outside

What does %ASA-1-106021 denote?

1. Type of request
2. Mnemonic message
3. Firewall action
4. Type of traffic

Question 76

Sophia, a forensic investigator, has been working on a significant corporate data theft case. The suspect, an IT employee, allegedly downloaded hundreds of confidential files onto his laptop before resigning abruptly. Sophia obtained a search and seizure warrant, and during the execution, she found the suspect’s laptop, a desktop computer, and several storage devices. To ensure she maintains the chain of custody and abides by the ACPO principles of digital evidence, what should be her next step?

1. She should immediately begin analyzing the digital devices on-site.
2. She should ask the suspect for the passwords to the devices to expedite the investigation.
3. She should only seize the personal laptop as per the information on the warrant.
4. She should seize all the devices and send them to a forensic lab for analysis.

Question 77

Which of the following tools will allow a forensic investigator to acquire the memory dump of a suspect machine so that it may be investigated on a forensic workstation to collect evidentiary data like processes and Tor browser artifacts?

1. DB Browser SQLite
2. Belkasoft Live RAM Capturer and AccessData FTK Imager
3. Bulk Extractor
4. Hex Editor

Question 78

Sophia, a forensic expert, is analyzing a system for signs of malware. She observes that the malware has been modifying Windows services and running processes to ensure its operation in the background without detection. She needs to determine which services are automatically starting when the system boots.

Which tool should Sophia use to examine the Windows services that are set to start automatically?

1. Autoruns
2. Task Manager
3. Process Explorer
4. Event Viewer

Question 79

The cybersecurity team of a leading software company is investigating an intricate network of infected systems in their infrastructure. Their research leads to a single file suspected to be the root cause of the infection. The malware in question is thought to be a novel one, and no prior information about it is available.

What would be the most viable initial step to understanding its potential capabilities and mode of operation?

1. Static Analysis
2. Behavioral Analysis
3. Signature Analysis
4. Code Analysis

Question 80

Evelyn, a forensic investigator, is tasked with analyzing a Linux machine suspected of harboring malicious activity. She needs to examine open files and identify which processes are associated with those files.

Which Volatility Framework plugin should Evelyn use to list the open files and their associated processes from a RAM image?

1. linux.pslist
2. linux.mount
3. linux.lsof
4. linux.malfind

Question 81

Jenny, a CHFI specialist, is assigned to a case involving potential corporate fraud within a major banking institution. A whistleblower from the bank has leaked terabytes of data online, which Jenny must examine for evidence. The sheer volume of the data, combined with the requirement to maintain the chain of custody and ensure that her findings can be used in court, makes her task quite daunting. Jenny knows that using the wrong approach could jeopardize the case, so she must choose her initial steps carefully.

What should Jenny’s strategy be to effectively deal with this mountain of digital evidence?

1. Download the leaked data and distribute it among her team for parallel analysis
2. Start examining the leaked data directly from the source of the leak
3. Prioritize the leaked data based on the whistleblower’s information, and conduct a selective examination
4. Create hash values for all leaked files before the examination to maintain data integrity and chain of custody

Question 82

Williamson is a forensic investigator. While investigating a case of data breach at a company, he is maintaining a document that records details such as the forensic processes applied on the collected evidence, particulars of people handling it, the dates and times when it is being handled, and the place of storage of the evidence.

What do you call this document?

1. Authorization form
2. Consent form
3. Chain of custody
4. Log book

Question 83

Andrew, a system administrator, is examining the UEFI boot process of a server. During the process, Andrew notices that the system is verifying the integrity of the bootloader and checking the settings before proceeding to load the operating system. The system performs cryptographic checks to ensure that only trusted software can be loaded. Andrew realizes this phase also ensures that the system boots in a secure state, adhering to policies.

Identify the UEFI boot process phase Andrew is currently in.

1. Boot device selection phase
2. Pre-EFI initialization phase
3. Driver execution environment phase
4. Security phase

Question 84

Fred, a cybercrime investigator for the FBI, finished storing a solid-state drive in a static resistant bag and filled out the chain of custody form. Two days later, John grabbed the solid-state drive and created a clone of it (with write blockers enabled) in order to investigate the drive. He did not document the chain of custody though.

When John was finished, he put the solid-state drive back in the static resistant bag and placed it back in the evidence locker. A day later, the court trial began and upon presenting the evidence and the supporting documents, the chief justice outright rejected them.

Which of the following statements strongly support the reason for rejecting the evidence?

1. John did not document the chain of custody
2. Block clones cannot be created with solid-state drives
3. Write blockers were used while cloning the evidence
4. John investigated the clone instead of the original evidence itself

Question 85

James, a forensics specialist, was tasked with investigating a Windows XP machine that was used for malicious online activities. During the investigation, he recovered certain deleted files from Recycle Bin to identify attack clues.

Identify the location of Recycle Bin in Windows XP system.

1. local/share/Trash
2. Drive:\RECYCLER\
3. Drive:\RECYCLED
4. Drive:\$Recycle.Bin\

Question 86

James, a highly skilled digital forensics expert, is working on a case involving an online crime. The suspect is believed to have conducted fraudulent activities through a network of compromised devices. The evidence trail is digital, leaving behind a complex web of data across various systems, including logs, metadata, and system/application timestamps. James focuses his investigation on collecting metadata from the suspect’s devices, scrutinizing system/application logs, and analyzing the timestamps of files and actions that occurred during the suspected time of the crime.

As James sifts through this digital trail, he is attempting to find data that will either directly link the suspect to the crime or provide supporting evidence that confirms the events that transpired. He understands that metadata and logs can reveal actions such as file access, document creation, application use, and network activity, all of which could help piece together the timeline of the suspect’s activities.

What role does this evidence serve in the investigation?

1. Exculpatory evidence
2. Corroborative evidence
3. Proof of the suspect’s actions
4. Identity verification

Question 87

David, a network forensic investigator, is reviewing the firewall logs after the security team reports a potential security incident. The company has recently experienced unusual traffic patterns, especially from external sources, and the IT department is concerned that a targeted attack may be underway. While reviewing the firewall logs, David spots several denied inbound connection attempts from an unfamiliar IP address. These attempts seem to originate from outside the expected network range. The connection attempts are consistently denied by the firewall, but they are occurring at unusual times, which raises concerns.

Given the heightened state of alert, David must determine if these suspicious connection attempts are part of a broader intrusion attempt or simply harmless scanning activity. As he examines the log details, he considers several factors to help him assess the seriousness of the situation. Among the details in the firewall log, which one will provide the most critical information to help David determine if these denied attempts are part of a potential intrusion attempt?

1. Source Port Number
2. Destination IP Address
3. Time of the Connection Attempt
4. Firewall Action Taken

Question 88

During an investigation, Noel found a SIM card from the suspect's mobile. The ICCID on the card is 8944245252001451548.

What does the first four digits (89 and 44) in the ICCID represent?

1. TAC and industry identifier
2. Industry identifier and country code
3. Country code and industry identifier
4. Issuer identifier number and TAC

Question 89

A forensic investigator is assigned to analyze a large volume of digital evidence related to a sophisticated cyberattack targeting a company’s internal network. The attack, which affected several systems across the enterprise, involved the exploitation of multiple vulnerabilities. Due to the complexity and scale of the case, the investigator decides to implement computerized forensic tools to streamline the investigation process.

These tools are used to create bit-by-bit copies of several suspect drives, ensuring the integrity of the original evidence and enabling further analysis without altering the original data.

In addition to creating forensic images, the investigator uses advanced hash analysis techniques to quickly identify potentially malicious files by comparing file hashes against known threat databases. Furthermore, to manage the large volume of event logs generated during the attack, the investigator utilizes forensic tools to analyze timestamps and generate a detailed timeline of activities. This timeline highlights key events in the attack, such as the initial breach, lateral movement within the network, and the exfiltration of sensitive data. By streamlining these tasks, the investigator can focus on the critical analysis required to understand the full scope of the attack.

Which forensic process is being described here?

1. Forensic orchestration integrating data storage management.
2. Forensic automation performing repetitive tasks efficiently.
3. Forensic orchestration managing multiple tasks in parallel.
4. Forensic automation providing manual analysis assistance.

Question 90

A computer forensics investigator or forensic analyst is a specially trained professional who works with law enforcement as well as private businesses to retrieve information from computers and other types of data storage devices. For this, the analyst should have an excellent working knowledge of all aspects of the computer.

Which of the following is not a duty of the analyst during a criminal investigation?

1. To recover data from suspect devices
2. To fill the chain of custody
3. To create an investigation report
4. To enforce the security of all devices and software in the scene

Question 91

In the aftermath of a sophisticated cyber-attack on a financial institution, forensic investigators are tasked with retrieving critical evidence from a compromised server. However, upon examination, they encounter encrypted files and password-protected directories, indicating attempts to thwart forensic analysis through password protection.

To counter these anti-forensic measures effectively, which of the following strategies would be most effective?

1. Utilizing a dictionary attack to systematically test common passwords against encrypted files and directories.
2. Utilizing rainbow tables to expedite the decryption process and bypass password protection mechanisms.
3. Deploying a targeted phishing campaign to obtain passwords or encryption keys safeguarding files and directories.
4. Conducting a brute-force attack to systematically guess the passwords of encrypted files and protected directories.

Question 92

A call detail record (CDR) provides metadata about calls made over a phone service. From the following data fields, which one is not contained in a CDR.

1. A unique sequence number identifying the record
2. The call duration
3. Phone number receiving the call
4. The language of the call

Question 93

A clothing company has recently deployed a website on its latest product line to increase its conversion rate and base of customers. Andrew, the network administrator recently appointed by the company, has been assigned with the task of protecting the website from intrusion and vulnerabilities.

Which of the following tool should Andrew consider deploying in this scenario?

1. Kon-Boot
2. Recuva
3. CryptaPix
4. ModSecurity

Question 94

An organization with a web application was compromised, and the attacker was able to download the entire database. During the initial review of the logs, the forensic investigator found several instances of the following string “%2e%2e%2f”.

What type of attack could have led to this breach?

1. Cross-Site Scripting (XSS) attack.
2. Directory Traversal attack.
3. SQL Injection attack.
4. Brute Force attack.

Question 95

POP3 is an Internet protocol, which is used to retrieve emails from a mail server. Through which port does an email client connect with a POP3 server?

1. 110
2. 143
3. 25
4. 993

Question 96

Robert who is a CHFI investigator is dealing with a complex case of corporate fraud. He’s secured multiple digital devices as evidence from different locations and at different times. His challenge is to prove in court that the evidence was not tampered with or modified from the time of seizure to the time of court presentation.

What key component will help Robert achieve this?

1. A robust Chain of Custody
2. Relying on the ACPO principles of digital evidence
3. A thorough sanitization of the target media
4. Seeking consent from all involved parties

Question 97

Which of the following Windows event logs record events related to device drivers and hardware changes?

1. Application log
2. Security log
3. Forwarded events log
4. System log

Question 98

James is a seasoned digital forensic investigator at an international law firm dealing with a convoluted case of industrial espionage. The attacker believed to be a disgruntled former employee, allegedly used a sophisticated network of compromised internal and external systems to steal sensitive data. Multiple jurisdictions and regulations are involved, with systems located in various countries. The firm’s legal team is concerned about the rules of evidence and obtaining the necessary warrants for search and seizure across different legal systems. To make matters more complex, some of the firm’s clients are refusing to give consent for James to access and investigate their systems, further complicating the evidence-gathering process.

What should James’s initial approach be in such a complex scenario?

1. Forego the search warrants and start the investigation based on available data
2. Proceed to access the clients’ systems covertly, as the firm owns the data
3. Work with the legal team to understand and respect each jurisdiction’s laws and seek necessary warrants
4. Limit the investigation to the firm’s internal systems to avoid legal complications

Question 99

Which set of anti-forensic tools/techniques allows a program to compress and/or encrypt an executable file to hide attack tools from being detected by reverse-engineering or scanning?

1. Emulators
2. Botnets
3. Password crackers
4. Packers

Question 100

Evelyn, a forensic investigator, is setting up a secure storage system to store critical evidence data. She purchases a new storage system that can support large disk sizes and ensures data integrity through the use of CRCs (Cyclic Redundancy Checks) and 64-bit Logical Block Addresses (LBAs). The system allows for partitions as large as 8 ZiB and can handle up to 128 partitions. After checking the specifications, Evelyn confirms that the partitioning scheme used by her system supports these capabilities.

What partitioning scheme is Evelyn using for her storage system?

1. BPB
2. GPT
3. MBR
4. Clusters

Question 101

In the course of a criminal investigation involving a suspect’s mobile devices, the forensic investigation team needs to analyze digital evidence from both Android and iOS smartphones. Each platform presents unique challenges and methodologies for forensic analysis.

To effectively extract and examine digital evidence from these devices, which of the following statements regarding Android and iOS forensic analysis is most accurate?

1. Both Android and iOS devices use the FAT32 file system, facilitating cross-platform compatibility and straightforward forensic analysis with widely available tools.
2. iOS offers robust open-source forensic tools for comprehensive digital evidence extraction, while Android relies on manual extraction due to limited forensic software support.
3. Android devices use Ext4 for straightforward file extraction with standard forensic tools; iOS devices, however, require specialized techniques due to APFS (Apple File System) encryption and complexity.
4. Android: Single partition aids forensic analysis; iOS: Sandbox, encryption complexities hinder data extraction.

Question 102

For the purpose of preserving the evidentiary chain of custody, which of the following labels is not appropriate?

1. SSN of the person collecting the evidence
2. Exact location the evidence was collected from
3. Relevant circumstances surrounding the collection
4. General description of the evidence

Question 103

ISO/IEC 17025 is an accreditation for which of the following:

1. CHFI issuing agency
2. Chain of custody
3. Encryption
4. Forensics lab licensing

Question 104

Derrick, a forensic specialist, was investigating an active computer that was executing various processes. Derrick wanted to check whether this system was used in an incident that occurred earlier. He started inspecting and gathering the contents of RAM, cache, and DLLs to identify incident signatures.

Identify the data acquisition method employed by Derrick in the above scenario.

1. Dead data acquisition
2. Non-volatile data acquisition
3. Static data acquisition
4. Live data acquisition

Question 105

"No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court" - this principle is advocated by which of the following?

1. FBI Cyber Division
2. Scientific Working Group on Imaging Technology (SWGIT)
3. The Association of Chief Police Officers (ACPO) Principles of Digital Evidence
4. Locard's exchange principle

Question 106

An expert witness is a __________________ who is normally appointed by a party to assist the formulation and preparation of a party’s claim or defense.

1. Expert in criminal investigation
2. Subject matter specialist
3. Witness present at the crime scene
4. Expert law graduate appointed by attorney

Question 107

David, a network security analyst, is tasked with investigating a possible breach involving an Apache web server. After reviewing the logs, he notices several failed login attempts, and HTTP error messages related to unavailable files.

Which of the following Apache log entries will provide the most useful information to help David determine whether these failed attempts were part of a larger security issue?

1. [Mon Dec 11 14:35:38.878945 2023] [core:notice] [pid 12356:tid 8689896234] [client 10.0.0.8] Connection closed gracefully
2. [Mon Dec 11 14:35:38.878945 2023] [core:error] [pid 12356:tid 8689896234] [client 10.0.0.8] File not found: /images/folder/pic.jpg
3. [Mon Dec 11 14:35:38.878945 2023] [mod_security:info] [pid 12356:tid 8689896234] [client 10.0.0.8] Rule triggered: Possible SQL Injection attempt
4. [Mon Dec 11 14:35:38.878945 2023] [auth:debug] [pid 12356:tid 8689896234] [client 10.0.0.8] Invalid user attempt

Question 108

Place the following in order of volatility from most volatile to the least volatile.

1. Archival media, temporary file systems, disk storage, archival media, register and cache
2. Register and cache, temporary file systems, routing tables, disk storage, archival media
3. Registers and cache, routing tables, temporary file systems, disk storage, archival media
4. Registers and cache, routing tables, temporary file systems, archival media, disk storage

Question 109

Which ISO Standard enables laboratories to demonstrate that they comply with quality assurance and provide valid results?

1. ISO/IEC 16025
2. ISO/IEC 18025
3. ISO/IEC 19025
4. ISO/IEC 17025

Question 110

Gary is checking for the devices connected to USB ports of a suspect system during an investigation.

Select the appropriate tool that will help him document all the connected devices.

1. DevScan
2. Devcon
3. fsutil
4. Reg.exe

Question 111

Smith, a network administrator with a large MNC, was the first to arrive at a suspected crime scene involving criminal use of compromised computers.

What should be his first response while maintaining the integrity of evidence?

1. Record the system state by taking photographs of physical system and the display
2. Perform data acquisition without disturbing the state of the systems
3. Open the systems, remove the hard disk and secure it
4. Switch off the systems and carry them to the laboratory

Question 112

Steve received a mail that seemed to have come from her bank. The mail has instructions for Steve to click on a link and provide information to avoid the suspension of her account. The link in the mail redirected her to a form asking for details such as name, phone number, date of birth, credit card number or PIN, CVV code, SSNs, and email address. On a closer look, Steve realized that the URL of the form is not the same as that of her bank's.

Identify the type of external attack performed by the attacker in the above scenario?

1. Espionage
2. Brute-force
3. Phishing
4. Tailgating

Question 113

Which of the following Event Correlation Approach is an advanced correlation method that assumes and predicts what an attacker can do next after the attack by studying the statistics and probability and uses only two variables?

1. Bayesian Correlation
2. Vulnerability-Based Approach
3. Rule-Based Approach
4. Route Correlation