Computer Hacking Forensic Investigator (CHFI)647 questions across 65 pages are complete and free, with no account or card.
647 questions in this bank
Free access · progress saved on this device
During an incident response to a data breach in a company's AWS environment, a forensic investigator is tasked to analyze and extract data from different storage types for further examination. What would be the most appropriate and effective course of action given that Amazon S3, EBS, and EFS were used?
Answer: D
A mid-sized enterprise recently suffered a security breach in their AWS-hosted application. The responsibility for identifying the source and cause of this breach falls under the purview of the internal security team. Based on the AWS shared responsibility model, which of the following would be the appropriate action for the team?
Answer: B
An individual skilled in Forensic Investigation has been summoned to look into a potentially unlawful transaction, believed to have unfolded on the shadowy expanses of the dark web. The investigator knows that the suspect used the Tor network for the transaction. Which of the following aspects of the Tor network should the investigator focus on primarily to trace the origin of the data transmission?
Answer: A
There's a digital forensics investigator delving into a case right now. The situation involves an SQL Server database that's been tampered with by an intruder. Some data from the database has vanished, and the real kicker is that there aren't any backup files to be found. The investigator's task is to recover as much data as possible. The investigator needs to understand which SQL Server data file will most likely assist in the data recovery. What should be the investigator's primary focus?
Answer: B
During a complex malware investigation, a forensic investigator found a binary executable suspected to contain malicious code. The investigator decides to perform static malware analysis to identify and analyze the threat. Which of the following actions should be performed next by the investigator to reveal essential information about the executable's functionalities and features?
Answer: C
A Computer Hacking Forensic Investigator is acquiring volatile data from a Linux-based suspect machine that they cannot physically access. They need to obtain a dump of the system's RAM remotely. Which of the following sequences of commands and tools should be utilized for a forensically sound extraction?
Answer: B
As a Computer Hacking Forensics Investigator, you have been tasked with examining a suspicious.E01 disk image file using The Sleuth Kit (TSK). You need to display the metadata structure of an inode but also want to show the addresses of its disk units. Which TSK command would best serve this purpose?
Answer: A
A Forensic Investigator is examining a potential malware incident on a corporate network. The investigator believes the malware might hide in the system's device drivers or alter system files and folders. Which combination of tools would be the most effective for uncovering and analyzing any potential malware hidden in these locations?
Answer: A
After an SQL Injection attack, an investigator is examining a log entry in an IIS log from a Windows-based server. The investigator notices a suspicious GET request: Id=ORD-001%27%20or%201=1;--. What can the investigator infer from this decoded query in the investigation?
Answer: C
A forensic investigator is examining a potential intrusion involving an Amazon Echo. The investigator has acquired an affected Echo and the smartphone synced to it. For further data analysis, he needs to retrieve relevant database files from the smartphone. Which files will the investigator primarily focus on to retrieve essential information?
Answer: A
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
312-49 practice, question 561. 647 questions available.
Version 1.0.0. How we source questions