Computer Hacking Forensic Investigator (CHFI)647 questions across 65 pages are complete and free, with no account or card.
647 questions in this bank
Free access · progress saved on this device
A cybersecurity investigator is working on a case involving a malicious executable suspected of being packed using a popular program packer. The investigator realizes that the packer used is password-protected. In such a scenario, what should be the investigator's first course of action to analyze the packed file?
Answer: C
A cybercrime investigator is evaluating a data breach in a company's AWS infrastructure. The breached service was categorized as an AWS container service. What primary security aspects were likely managed by the company and not by AWS, which the investigator should first focus on?
Answer: D
A CHFI has been tasked to analyze Windows Security Logs in a highly complex and multi-layered security breach investigation. The breach involved an account creation, privilege escalation, and the installation of a service, all happening sequentially within a short duration. The investigator is required to retrieve a combination of Event IDs that would chronologically corroborate these events. Which combination of Event IDs should the investigator focus on?
Answer: C
A Computer Hacking Forensics Investigator (CHFI) has been asked to retrieve specific email files from a large RAID server after a data breach. Additionally, fragments of unallocated (deleted) data are also required. However, there is a severe constraint on time and resources. Considering these requirements, which type of data acquisition should the investigator primarily focus on?
Answer: C
In an email crime investigation, the forensic investigator analyses a computer using the Microsoft Outlook application. The investigator knows that Outlook stores email data in both .pst and .ost file formats. They want to focus on the files that hold the email data even when there is no internet connection. Which files should the investigator target for a deeper analysis?
Answer: A
A major corporation has faced multiple SQL injection attacks on its web application. They have a ModSecurity WAF in place with default settings. However, attacks are still getting through. The forensic investigator recommends a measure to enhance security. What is the most likely recommendation?
Answer: A
As a Computer Hacking Forensic Investigator, you are analyzing an intrusion incident in a corporate network. You discovered the traces of a fileless malware attack that utilized a memory exploit. The indicators suggest that the initial payload was delivered via a malicious Word document received through a phishing email. As part of the response and prevention plan, which among the following steps would be the most effective to disrupt the Infection Chain of the detected fileless malware?
Answer: C
The investigative team at a private security firm is conducting a forensic examination of a complex cyberattack case. They need to follow the ACPO Principles of Digital Evidence during the investigation. However, one of the investigators is unsure of some of these principles. Which of the following statements correctly represents the ACPO principles?
Answer: C
As a Computer Hacking Forensics Investigator, you are tasked with tracing a series of illegal transactions believed to originate from the dark web. You know the transactions were made using Tor, a browser providing anonymity. However, in an authoritarian country where the usage of the Tor network is restricted, the suspect is believed to be using an undisclosed Tor network feature to bypass these restrictions. What feature is likely being used in this scenario?
Answer: C
Forensic Investigator Alex has to collect data from a suspect's large drive in a time-bound investigation. The court would allow him to retain the original drive. Considering these factors, what should be Alex's primary considerations to ensure a forensically sound data acquisition?
Answer: D
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
312-49 practice, question 571. 647 questions available.
Version 1.0.0. How we source questions