Computer Hacking Forensic Investigator (CHFI)647 questions across 65 pages are complete and free, with no account or card.
647 questions in this bank
Free access · progress saved on this device
A forensic investigator is tasked with logically acquiring data from an Android device involved in a cybercrime incident. The device is passcode protected, and the suspect refuses to reveal the passcode. How should the investigator proceed?
Answer: A
A sophisticated cyber-attack has targeted an organization, and the forensic team is called upon for incident response. Their assets are largely hosted on AWS, particularly using S3 and EC2 instances. As a forensic investigator, your first step to retaining valuable evidence in the EC2 instances is:
Answer: D
A digital forensics investigator is examining a suspect's hard disk drive. The hard disk is known to have 16,384 cylinders, 16 heads, and 63 sectors per track, with a sector size of 512 bytes. During the investigation, the forensic analyst identifies a particular file that resides in two sectors. Considering that each sector contains data plus overhead information such as ID, synchronization fields. ECC, and gaps, what is the maximum potential size of this particular file stored on the disk?
Answer: A
A forensic investigator is analyzing a Windows system for possible malicious activity. The investigator is specifically interested in the recent actions of a suspect on the system, including any deleted directories or files, mounted drives, and actions taken. Which of the following approaches and tools would be the most effective for obtaining this information?
Answer: A
In a scenario where a potential security incident has occurred on a cloud-based service, and an investigator is brought in to examine the system, what type of data acquisition would likely be beneficial in this situation? Also, explain the volatile data type that might be most interesting to the investigator.
Answer: C
A cybersecurity forensic investigator analyzes log files to investigate an SQL Injection attack. While going through the Apache across.log, they come across a GET request from the IP 10.0.0.19 containing an encoded query string: GET /sqli/examplel.php?name=root' UniON SeLeCT 1,table_name,3,4,5 From information_schema.tables where Table_Schema=DatabasE() limit 1,2--- What is the intention behind the attacker’s query?
Answer: B
A forensic investigator discovers an Android smartwatch at the crime scene during an investigation. The investigator realizes the smartwatch was potentially involved in the crime, but the device associated with it was not found at the scene. What is the most suitable initial step for the investigator to retrieve meaningful data from the smartwatch?
Answer: C
In the event of a fileless malware attack, a Computer Hacking Forensics Investigator (CHFI) notes that the fileless malware has managed to persist even after the system reboots. What built-in Windows tool/utility might the attacker most likely have leveraged for this persistent behavior?
Answer: C
An organization suspects that a former temporary employee may have used steganography to hide sensitive information within multimedia files for unauthorized extraction. The company has launched an internal steganalysis process to uncover the potential breach. The steganalyst discovered some unusual patterns within a specific image file as part of the investigation. Which steganalysis attack techniques are most likely being applied in this scenario?
Answer: C
During an investigation of a suspected email crime, the forensics team noted that the criminal used emails to sell illegal narcotics and execute numerous frauds. The team identified that the criminal had also used an advanced phishing technique to target a specific executive in the victim’s organization. Which phishing technique was likely used in this scenario?
Answer: B
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
312-49 practice, question 621. 647 questions available.
Version 1.0.0. How we source questions