Computer Hacking Forensic Investigator (CHFI) practice questions

1. Question 1 of 25

   Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool?

   • AA disk imaging tool would check for CRC32s for internal self-checking and validation and have MD5 checksum
   • BEvidence file format will contain case data entered by the examiner and encrypted at the beginning of the evidence file
   • CA simple DOS copy will not include deleted files, file slack and other information
   • DThere is no case for an imaging tool as it will use a closed, proprietary format that if compared to the original will not match up sector for sector

   Show answer

   Correct answer: C

   Explanation

   A disk imaging tool not necessarily will check for CRC32s and not even is a requeriment in fact, to be able to perform any kind of validation by itself. But, a DOS copy will not take those elements we will need for our investigation. So, think answer is absolutly correct.

   Adapted from community discussion by Bodescu · 2022-11-04 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion3

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

   1. B

      Bodescu

      2022-11-04

      2 upvotes

      A disk imaging tool not necessarily will check for CRC32s and not even is a requeriment in fact, to be able to perform any kind of validation by itself. But, a DOS copy will not take those elements we will need for our investigation. So, think answer is absolutly correct.

   2. L

      larajorge

      2022-10-18

      1 upvote

      I believe answer should be A. The question asks why I would recommend a disk imaging tool, it is not asking what is the issue with a DOS copy.

   3. S

      simbai

      2024-09-23

      1 upvote

      I would like to agree with larajorge on this one. The answer should be A

2. Question 2 of 25

   One technique for hiding information is to change the file extension from the correct one to one that might not be noticed by an investigator. For example, [1] extension?

   • Athe File Allocation Table
   • Bthe file header
   • Cthe file footer
   • Dthe sector map

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   One technique for hiding information is to change the file extension from the correct one to one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a document. What can an investigator examine to verify that a file has the correct extension?

   Adapted from community discussion by Selzar · 2023-05-18 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion3

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

   1. S

      Selzar

      2023-05-18

      13 upvotes

      One technique for hiding information is to change the file extension from the correct one to one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a document. What can an investigator examine to verify that a file has the correct extension?

   2. B

      Bodescu

      2023-11-04

      3 upvotes

      You can change the ext, of course. But file header will not change. So, if you set a .doc ext to a JPG file, file header will be FFD8FF anyway. Try by yourself: Use a JPG, open with any hex editor and have a look. Then, change the ext to .doc. Any changes to the file header? :)

   3. T

      TQ1BBK

      2025-03-09

      Selected B1 upvote

      For example, one technique for hiding information is to change the file extension from the correct one to the file header. So, the correct answer is: B. the file header

3. Question 3 of 25

   You have completed a forensic investigation case. You would like to destroy the data contained in various disks at the forensics lab due to sensitivity of the case. How would you permanently erase the data on the hard disk?

   • AThrow the hard disk into the fire
   • BRun the powerful magnets over the hard disk
   • CFormat the hard disk multiple times using a low level disk utility
   • DOverwrite the contents of the hard disk with Junk data

   Show answer

   Correct answer: A

   Explanation

   based on the original EC-Council material: Methods like hard drive formatting or deleting partitions cannot delete the file data completely. However, it is important to destroy the data and protect it from retrieval, after the collection of evidence from the computer. Therefore, the only way to erase the data completely and protect it from recovery is to overwrite the data by applying a code of sequential zeroes or ones. (EC-Council 81) EC-Council. Computer Hacking Forensics Investigator (CHFI) Version 9 eBook w/ iLabs (Volumes 1 through 4). EC-Council Academia, 01/2017. VitalBook file. The citation provided is a guideline. Please check each citation for accuracy before use. so I think answer would be "D"

   Adapted from community discussion by linuxer · 2021-05-10 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

   1. L

      linuxer

      2021-05-10

      2 upvotes

      based on the original EC-Council material: Methods like hard drive formatting or deleting partitions cannot delete the file data completely. However, it is important to destroy the data and protect it from retrieval, after the collection of evidence from the computer. Therefore, the only way to erase the data completely and protect it from recovery is to overwrite the data by applying a code of sequential zeroes or ones. (EC-Council 81) EC-Council. Computer Hacking Forensics Investigator (CHFI) Version 9 eBook w/ iLabs (Volumes 1 through 4). EC-Council Academia, 01/2017. VitalBook file. The citation provided is a guideline. Please check each citation for accuracy before use. so I think answer would be "D"

   2. F

      Fabsauro

      2022-03-15

      1 upvote

      Low-level formatting is a procedure where you write data directly to the storage medium, bypassing the filesystem layer. You do not care if the hard disk has one partition or more, NTFS or BTRFS or anything else. You are using the device driver, which can be IDE or SCSI or SATA or others, and you're writing data to physical sectors. More importantly, low level formatting will write to each and every bit on the storage device, making sure the old states are destroyed forever, and with them, any trace of former data previously stored. Performing one low-level formatting operation is known as one-pass format. Some security consultants and experts and paranoids might recommend you perform three or more passes, to make absolutely sure no trace of old data can ever be retrieved. Statistically, this is a total overkill, but the choice is entirely yours. From: https://www.dedoimedo.com/computers/low-level-formatting.html SHD be C !

   3. M

      manarkmq

      2024-07-31

      1 upvote

      Methods like hard drive formatting or deleting partitions cannot delete the file data completely. However, it is important to destroy the data and protect it from retrieval, after the collection of evidence from the computer. Therefore, the only way to erase the data completely and protect it from recovery is to overwrite the data by applying a code of sequential zeroes or ones. from the book so it is d

   4. A

      Ariel235788

      2022-12-29

      1 upvote

      formatting does not erase the data completely. you can format a drive and still use forensic tools to pull data off. Even over-writing files you can still pull data. Magnets will be useful if you intend on data destruction but completely 100% destroying the disk is the way to go. Hence, A, cast it into the fire. Incineration means you cant ever use the disk again.

4. Question 4 of 25

   When you are running a vulnerability scan on a network and the IDS cuts off your connection, what type of IDS is being used?

   • APassive IDS
   • BActive IDS
   • CProgressive IDS
   • DNIPS

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   Look that.. Intrusion detection systems (IDS) can be classified into different ways. The major classifications are Active and passive IDS, Network Intrusion detection systems (NIDS) and host Intrusion detection systems (HIDS) Active and passive IDS An active Intrusion Detection Systems (IDS) is also known as Intrusion Detection and Prevention System (IDPS). Intrusion Detection and Prevention System (IDPS) is configured to automatically block suspected attacks without any intervention required by an operator. Intrusion Detection and Prevention System (IDPS) has the advantage of providing real-time corrective action in response to an attack. A passive IDS is a system that’s configured to only monitor and analyze network traffic activity and alert an operator to potential vulnerabilities and attacks. A passive IDS is not capable of performing any protective or corrective functions on its own. https://www.omnisecu.com/security/infrastructure-and-email-security/types-of-intrusion-detection-systems.php

   Adapted from community discussion by Fabsauro · 2022-03-16 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

   1. F

      Fabsauro

      2022-03-16

      3 upvotes

      Look that.. Intrusion detection systems (IDS) can be classified into different ways. The major classifications are Active and passive IDS, Network Intrusion detection systems (NIDS) and host Intrusion detection systems (HIDS) Active and passive IDS An active Intrusion Detection Systems (IDS) is also known as Intrusion Detection and Prevention System (IDPS). Intrusion Detection and Prevention System (IDPS) is configured to automatically block suspected attacks without any intervention required by an operator. Intrusion Detection and Prevention System (IDPS) has the advantage of providing real-time corrective action in response to an attack. A passive IDS is a system that’s configured to only monitor and analyze network traffic activity and alert an operator to potential vulnerabilities and attacks. A passive IDS is not capable of performing any protective or corrective functions on its own. https://www.omnisecu.com/security/infrastructure-and-email-security/types-of-intrusion-detection-systems.php

   2. A

      apetro76

      2021-12-24

      4 upvotes

      Question does not make sense. IDS is for detection only it would not cut off your connection only IPS can actively interfere with ongoing connections.

   3. S

      Spudmac

      2022-10-23

      3 upvotes

      The answer should be D. in a way. I(D)S only detects and doesn't actively protect or interfere. Only an IPS does that.

   4. C

      Ceh2024

      2024-09-03

      Selected B1 upvote

      The question is "what type of IDS is being used?". So the Active IDS is the best answer. Active IDS have a different name is an intrusion detection and prevention system (IDPS). Snort is an example

5. Question 5 of 25

   You are a security analyst performing a penetration tests for a company in the Midwest. After some initial reconnaissance, you discover the IP addresses of some Cisco routers used by the company. You type in the following URL that includes the IP address of one of the routers: http://172.168.4.131/level/99/exec/show/config After typing in this URL, you are presented with the entire configuration file for that router. What have you discovered?

   • AHTTP Configuration Arbitrary Administrative Access Vulnerability
   • BHTML Configuration Arbitrary Administrative Access Vulnerability
   • CCisco IOS Arbitrary Administrative Access Online Vulnerability
   • DURL Obfuscation Arbitrary Administrative Access Vulnerability

   Show answer

   Correct answer: A

   Explanation

   Answer is A. https://www.rapid7.com/db/vulnerabilities/HTTP-CISCO-0002/ The problem is in the ability of a user to access the HTTP configuration menu of a Cisco device. A remote user accessing: http://router.address/level/$NUMBER/exec/.... (where $NUMBER is a number in the range of 16 to 99) bypasses all authentication checking. This leads to a remote user gaining a privilege level of 15, which in IOS software is full administrative access (also known as enable). With administrative access, remote attackers may be able to further compromise the network. They may be able to, for example: divert/redirect traffic, possibly monitor traffic, and/or cause a denial of service

   Adapted from community discussion by Xfo · 2023-07-26 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion3

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

   1. X

      Xfo

      2023-07-26

      3 upvotes

      Answer is A. https://www.rapid7.com/db/vulnerabilities/HTTP-CISCO-0002/ The problem is in the ability of a user to access the HTTP configuration menu of a Cisco device. A remote user accessing: http://router.address/level/$NUMBER/exec/.... (where $NUMBER is a number in the range of 16 to 99) bypasses all authentication checking. This leads to a remote user gaining a privilege level of 15, which in IOS software is full administrative access (also known as enable). With administrative access, remote attackers may be able to further compromise the network. They may be able to, for example: divert/redirect traffic, possibly monitor traffic, and/or cause a denial of service

   2. A

      Ariel235788

      2024-06-29

      1 upvote

      missing the whole 'HTTP' part, at least answer A has the whole but not Cisco IOS at the beginning. idk lame answer choices tbh

   3. D

      deadguy1000

      2023-07-22

      1 upvote

      The answer should be C as shown here https://www.rapid7.com/db/vulnerabilities/HTTP-CISCO-0002/

6. Question 6 of 25

   Jim performed a vulnerability analysis on his network and found no potential problems. He runs another utility that executes exploits against his system to verify the results of the vulnerability test. The second utility executes five known exploits against his network in which the vulnerability analysis said were not exploitable. What kind of results did Jim receive from his vulnerability analysis?

   • AFalse negatives
   • BFalse positives
   • CTrue negatives
   • DTrue positives

   Show answer

   Correct answer: A

   Explanation

   the true/false/positive/negative thing can get confusing, it's best to think of it in terms of access control: TRUE positive = a correctly established positive result (authorised person is granted access) TRUE negative = a correctly established negative result (unauthorised person is not granted access) FALSE positive = an incorrectly established positive result (unauthorised person is granted access) FALSE negative = an incorrectly established negative result (an authorised person is not granted access) this concept applied to the question would be a false negative - the scanner incorrectly (false) established that these vulnerabilities were not exploitable (negative).

   Adapted from community discussion by jaycc · 2023-07-08 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

   1. J

      jaycc

      2023-07-08

      4 upvotes

      the true/false/positive/negative thing can get confusing, it's best to think of it in terms of access control: TRUE positive = a correctly established positive result (authorised person is granted access) TRUE negative = a correctly established negative result (unauthorised person is not granted access) FALSE positive = an incorrectly established positive result (unauthorised person is granted access) FALSE negative = an incorrectly established negative result (an authorised person is not granted access) this concept applied to the question would be a false negative - the scanner incorrectly (false) established that these vulnerabilities were not exploitable (negative).

   2. A

      AkrAm_FetyAn

      2023-11-16

      2 upvotes

      totally wrong jaycc • True positive: A worm is spreading on a trusted network; NIDS alerts • True negative: User surfs the Web to an allowed site; NIDS is silent • False positive: User surfs the Web to an allowed site; NIDS alerts • False negative: A worm is spreading on a trusted network; NIDS is silent

   3. A

      apetro76

      2023-06-25

      2 upvotes

      Question doesn't indicate whether or not the second utility tests are successful leaving two possible answers a,c

   4. S

      stickerbush1970

      2023-07-07

      1 upvote

      The second utility executes five known exploits against his network in which the vulnerability analysis said were not exploitable. What kind of results did Jim receive from his vulnerability analysis? Since the second utility is executing 5 Known exploits (TRUE), were not exploitable (NEGATIVE).

7. Question 7 of 25

   Software firewalls work at which layer of the OSI model?

   • AApplication
   • BNetwork
   • CTransport
   • DData Link

   Show answer

   Correct answer: D

   Explanation

   Point is not, if firewall is or not an application. Is, obviously. And as application, that fw works at OSI layer 7. Point is, what OSI layer that fw is inspecting. If you filter based on IP address (for example), you can say that your firewall is filtering at layer 3. If you filter specific ports, you can say you're filtering at layer 4. If your firewall inspects specific protocol states or data, you can say it operates at layer 7. Software fw usually inspects OSI layer 2 pdus. So, data link :)

   Adapted from community discussion by Bodescu · 2023-11-05 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion3

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

   1. B

      Bodescu

      2023-11-05

      2 upvotes

      Point is not, if firewall is or not an application. Is, obviously. And as application, that fw works at OSI layer 7. Point is, what OSI layer that fw is inspecting. If you filter based on IP address (for example), you can say that your firewall is filtering at layer 3. If you filter specific ports, you can say you're filtering at layer 4. If your firewall inspects specific protocol states or data, you can say it operates at layer 7. Software fw usually inspects OSI layer 2 pdus. So, data link :)

   2. A

      Ariel235788

      2024-07-01

      1 upvote

      ISA Server 2004 is a software firewall ... Microsoft defines ISA Server 2004 as “an advanced application layer firewall ... ISA Server 2004 includes the following key features: multi-layer inspection, advanced application layer filtering, secure inbound traffic and protection from “inside attacks” via VPN client connections, integrated multi-networking capabilities, network templates, and stateful routing and inspection. Sounds like a NGFW but i mean. Yeah definitely should be A IMO

   3. A

      Ariel235788

      2024-07-01

      1 upvote

      https://www.sciencedirect.com/topics/computer-science/layer-firewall

8. Question 8 of 25

   What type of equipment would a forensics investigator store in a StrongHold bag?

   • APDAPDA?
   • BBackup tapes
   • CHard drives
   • DWireless cards

   Show answer

   Correct answer: D

   Explanation

   A should be the answer. As without connecting, an wireless card is unusable. But in case of PDA, it is best practice to keep it turned on and hence should be put inside strongholds to deprive any communication.

   Adapted from community discussion by ireen · 2019-08-25 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

   1. I

      ireen

      2019-08-25

      3 upvotes

      A should be the answer. As without connecting, an wireless card is unusable. But in case of PDA, it is best practice to keep it turned on and hence should be put inside strongholds to deprive any communication.

   2. A

      Ariel235788

      2022-01-02

      1 upvote

      Def should be a PDA. You would keep a phone inside of a StrongHold bag. Wireless card is going to be in the same class as a data storage device. Why would a wireless card be singled out? Makes no sense compared to an electronic communications device

   3. S

      Spudmac

      2021-10-23

      1 upvote

      How could a Wireless card communicate on its own without a power source other than an NFC capable one? I've never heard of a NFC capable Wireless Card.

   4. D

      d25a691

      2024-08-22

      1 upvote

      Answer is D. If it's wireless the "hacker" can flush the data out of the card, that is why it needs to be in the bag

9. Question 9 of 25

   What is the CIDR from the following screenshot?

   

   • A/24A./24A./24
   • B/32 B./32 B./32
   • C/16 C./16 C./16
   • D/8D./8D./8

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   FYI, (im 99% sure theres no one studying this exam that would need this info) /32 = 255.255.255.255, /24 = 255.255.255.0, /16 = 255.255.0.0, /8 = 255.0.0.0

   Adapted from community discussion by Ariel235788 · 2023-01-02 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion2

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

   1. A

      Ariel235788

      2023-01-02

      3 upvotes

      FYI, (im 99% sure theres no one studying this exam that would need this info) /32 = 255.255.255.255, /24 = 255.255.255.0, /16 = 255.255.0.0, /8 = 255.0.0.0

   2. C

      Ceh2024

      2024-08-30

      Selected D1 upvote

      The correct answer D just /8. It looks like there is a typo in the answer

10. Question 10 of 25

    What file is processed at the end of a Windows XP boot to initialize the logon dialog box?

    • ANTOSKRNL.EXE
    • BNTLDR
    • CLSASS.EXE
    • DNTDETECT.COM

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    The correct answer is A, because the question is asking the file processed BEFORE the logon dialog box appears. Basically, they are asking the required file that is processed before winlogon.exe (the exe that shows the logon dialog box), which is ntoskrnl.exe. http://etutorials.org/Microsoft+Products/microsoft+windows+xp+professional+training+kit/Chapter+18+-+Modifying+and+Troubleshooting+the+Boot+Process/Lesson+1nbspUnderstanding+the+Boot+Process/

    Adapted from community discussion by ayaneru_inorin · 2023-12-16 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

    1. A

       ayaneru_inorin

       2023-12-16

       2 upvotes

       The correct answer is A, because the question is asking the file processed BEFORE the logon dialog box appears. Basically, they are asking the required file that is processed before winlogon.exe (the exe that shows the logon dialog box), which is ntoskrnl.exe. http://etutorials.org/Microsoft+Products/microsoft+windows+xp+professional+training+kit/Chapter+18+-+Modifying+and+Troubleshooting+the+Boot+Process/Lesson+1nbspUnderstanding+the+Boot+Process/

    2. C

       Ceh2024

       2024-09-04

       Selected C1 upvote

       The question is "What file is processed at the end of a Windows XP boot ?" . Actually the Session Manager Process (SMSS.EXE) triggers Winlogon.exe, which presents the user login screen for user authorization. However the SMSS.EXE is not the option in this question. So LSASS.EXE is the best answer because this file is processed at the end of Windows XP boot process.

    3. G

       giangvd

       2022-08-07

       1 upvote

       Logon The logon process begins at the conclusion of the kernel initialization phase. The Win32 subsystem automatically starts WINLOGON.EXE, which starts the Local Security Authority (LSASS.EXE) and displays the Logon dialog box. You can log on at this time, even though Windows XP Professional might still be initializing network device drivers.

    4. J

       jedimaster99999999

       2023-02-10

       2 upvotes

       Is there really still questions about Windows XP on version 10?

11. Question 11 of 25

    Which password cracking technique uses details such as length of password, character sets used to construct the password, etc.?

    • ADictionary attack
    • BBrute force attack
    • CRule-based attack
    • DMan in the middle attack

    Show answer

    Correct answer: A

    Explanation

    Rule-based is the right answer, Dictionary is just the use of common words specific to a dictionary. The question clearly states out some basic rules like the character length, involving special symbols....

    Adapted from community discussion by ZeroDay · 2023-04-28 · 16 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

    1. Z

       ZeroDay

       2023-04-28

       16 upvotes

       Rule-based is the right answer, Dictionary is just the use of common words specific to a dictionary. The question clearly states out some basic rules like the character length, involving special symbols....

    2. C

       Cytrail

       2024-03-15

       1 upvote

       I think the answer (A) is correct, every index mentioned is applicable to Dictionary Attack. Dictionary attacks work because many computer users and businesses insist on using ordinary words as passwords. Dictionary attacks are rarely successful against systems that employ multiple-word phrases, and unsuccessful against systems that employ random combinations of uppercase and lowercase letters mixed up with numerals. In those systems, the brute-force method of attack (in which every possible combination of characters and spaces is tried up to a certain maximum length) can sometimes be effective, although this approach can take a long time to produce results.

    3. F

       Fabsauro

       2024-03-30

       2 upvotes

       https://www.skillset.com/questions/whats-a-rule-based-password-attack-7722

    4. S

       Spudmac

       2024-10-11

       1 upvote

       Admin: Can we have the right answer changed to C. Rule-based attack, please? There's over whelming support for the change.

12. Question 12 of 25

    Wireless access control attacks aim to penetrate a network by evading WLAN access control measures such as AP MAC filters and Wi-Fi port access controls. Which of the following wireless access control attacks allow the attacker to set up a rogue access point outside the corporate perimeter and then lure the employees of the organization to connect to it?

    • AAd hoc associations
    • BClient mis-association
    • CMAC spoofing
    • DRogue access points

    Show answer

    Correct answer: B

    Explanation

    I understand a Client mis-association as a consequence of a rogue access point, but a Rogue Access Point is the attack vector. I think the correct answer should be D.

    Adapted from community discussion by larajorge · 2024-04-25 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

    1. L

       larajorge

       2024-04-25

       2 upvotes

       I understand a Client mis-association as a consequence of a rogue access point, but a Rogue Access Point is the attack vector. I think the correct answer should be D.

    2. S

       Spudmac

       2024-10-24

       1 upvote

       Wouldn't a rogue access point be a consequence of a mis(dis)-association attack? Because a user is mis-associated from the legitimate AP, they now can be lured/connected to a Rouge Access Point.

    3. S

       Spudmac

       2024-10-11

       1 upvote

       I understand your reasoning. This is an EC-Council thing. If this were a CompTIA question it would be more clear to point out the fact that its a mis-associating attack.

13. Question 13 of 25

    Which of the following options will help users to enable or disable the last access time on a system running Windows 10 OS?

    • Awmic service
    • BReg.exe
    • Cfsutil
    • DDevcon

    Show answer

    Correct answer: C

    How others answered

    • C67%
    • A33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    On Windows 10, you can also run fsutil command in an elevated command prompt to query, enable, or disable “Last Access Time” - Computer Hacking Forensics Investigator (CHFI) Version 10 - EC-Council Pg. 615

    Adapted from community discussion by Ceh2024 · 2024-08-31 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

    1. C

       Ceh2024

       2024-08-31

       Selected C2 upvotes

       On Windows 10, you can also run fsutil command in an elevated command prompt to query, enable, or disable “Last Access Time” - Computer Hacking Forensics Investigator (CHFI) Version 10 - EC-Council Pg. 615

    2. A

       Ariel235788

       2023-01-04

       1 upvote

       Given answer is correct. https://winaero.com/disable-ntfs-last-access-time-updates-in-windows-10/ "Alternatively, you can use the console tool fsutil to configure the Last Access Time Stamp feature for NTFS."

14. Question 14 of 25

    Bob has encountered a system crash and has lost vital data stored on the hard drive of his Windows computer. He has no cloud storage or backup hard drives. he wants to recover all those data, which includes his personal photos, music, documents, videos, official email, etc. Which of the following tools shall resolve Bob's purpose?

    • AColasoft's Capsa
    • BRecuva
    • CCain & Abel
    • DXplico

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    Recuva is an undeletion program for Windows, developed by Piriform. It is able to undelete files that have been marked as deleted; the operating system marks the areas of the disk in which they were stored as free space.

    Adapted from community discussion by Selzar · 2021-11-16 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

    1. S

       Selzar

       2021-11-16

       3 upvotes

       Recuva is an undeletion program for Windows, developed by Piriform. It is able to undelete files that have been marked as deleted; the operating system marks the areas of the disk in which they were stored as free space.

    2. B

       Bright07

       2022-02-18

       3 upvotes

       Recuva is the right answer Which is B. Please can you update it

    3. S

       Selzar

       2021-11-16

       2 upvotes

       A quick Google search shows: Xplico is a network forensics analysis tool, which is a software that reconstructs the contents of acquisitions performed with a packet sniffer.

15. Question 15 of 25

    Which of the following commands shows you all of the network services running on Windows-based servers?

    • ANetstart
    • BNet Session
    • CNet use
    • DNet config

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    The net command with start parameter will show you up all the running services, including network ones. https://ss64.com/nt/net-service.html netstat with no parameters displays active TCP connections. https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/netstat

    Adapted from community discussion by Bodescu · 2021-11-06 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn

    View community discussion1

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

    1. B

       Bodescu

       2021-11-06

       2 upvotes

       The net command with start parameter will show you up all the running services, including network ones. https://ss64.com/nt/net-service.html netstat with no parameters displays active TCP connections. https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/netstat

16. Question 16 of 25

    Which among the following search warrants allows the first responder to get the victim's computer information such as service records, billing records, and subscriber information from the service provider?

    • ACitizen Informant Search Warrant
    • BElectronic Storage Device Search Warrant
    • CJohn Doe Search Warrant
    • DService Provider Search Warrant

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    100% sure D is the correct answer according to Computer Hacking Forensics Investigator (CHFI) Version 10 - EC-Council Pg. 120. Service Provider Search Warrant warrant allows the investigator to get the victim’s computer information such as service records, billing records, and subscriber information from the service provider

    Adapted from community discussion by Ceh2024 · 2024-08-31 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

    1. C

       Ceh2024

       2024-08-31

       Selected D2 upvotes

       100% sure D is the correct answer according to Computer Hacking Forensics Investigator (CHFI) Version 10 - EC-Council Pg. 120. Service Provider Search Warrant warrant allows the investigator to get the victim’s computer information such as service records, billing records, and subscriber information from the service provider

    2. G

       giangvd

       2022-08-11

       2 upvotes

       Service provider search warrant If the crime involves the Internet, the first responder needs information about the victim’s computer from the service provider end. A service provider search warrant allows first responders or investigators to consult the service provider and obtain the available victim’s computer information. First responders can obtain the following information from the service provider:  Service records  Billing records  Subscriber information

17. Question 17 of 25

    Which MySQL log file contains information on server start and stop?

    • ASlow query log file
    • BGeneral query log file
    • CBinary log
    • DError log file

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    Question should have the word 'unintended'. From the book : 'examine the error log files and check if there are any unintended startup/shutdown events'

    Adapted from community discussion by OrlandoC · 2021-09-14 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

    1. L

       larajorge

       2022-04-28

       3 upvotes

       Answer D is correct, as indicated in MySQL documentation itself. https://dev.mysql.com/doc/refman/8.0/en/error-log.html

    2. O

       OrlandoC

       2021-09-14

       2 upvotes

       Question should have the word 'unintended'. From the book : 'examine the error log files and check if there are any unintended startup/shutdown events'

    3. C

       Ceh2024

       2024-08-31

       Selected D1 upvote

       D is correct answer. Computer Hacking Forensics Investigator (CHFI) Version 10 EC-Council P. 1076

18. Question 18 of 25

    Smith, a forensic examiner, was analyzing a hard disk image to find and acquire deleted sensitive files. He stumbled upon a $Recycle.Bin folder in the root directory of the disk. Identify the operating system in use.

    • AWindows 98
    • BLinux
    • CWindows 8.1
    • DWindows XP

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    From the Official CHFI Exam guide: Chapter 4, pg. 208 "■ On FAT file systems, the folder is named Recycled. For example, on your C: the storage location of the Recycle Bin would be C:\RECYCLED. ■ On NTFS file systems used by Windows NT, 2000, and XP, this folder is named Recycler. For example, on your C: the storage location of the Recycle Bin would be C:\RECYCLER. ■ On NTFS file systems used by Windows Vista, this folder is named $Recycle.Bin. For example, on your C: the storage location of the Recycle Bin would be C:\RECYCLE.BIN." So seems clear, answer should be C

    Adapted from community discussion by Bodescu · 2023-05-06 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

    1. B

       Bodescu

       2023-05-06

       3 upvotes

       From the Official CHFI Exam guide: Chapter 4, pg. 208 "■ On FAT file systems, the folder is named Recycled. For example, on your C: the storage location of the Recycle Bin would be C:\RECYCLED. ■ On NTFS file systems used by Windows NT, 2000, and XP, this folder is named Recycler. For example, on your C: the storage location of the Recycle Bin would be C:\RECYCLER. ■ On NTFS file systems used by Windows Vista, this folder is named $Recycle.Bin. For example, on your C: the storage location of the Recycle Bin would be C:\RECYCLE.BIN." So seems clear, answer should be C

    2. C

       Cytrail

       2023-03-15

       3 upvotes

       Drive:\Recycled = Win 98 and Prior Win Versions Drive:\Recycler = Win 2000, Win XP & Win NT Drive:\$Recycle.Bin = Win Vista, Win 7, Win 8, Win 10, Win... With these few points of mine, the answer is "C".

    3. B

       Bright07

       2023-02-19

       1 upvote

       Correct Ans is D Window 98 = Recycled, Window XP = Recycle and Window 8.1 Recycler

19. Question 19 of 25

    How will you categorize a cybercrime that took place within a CSP's cloud environment?

    • ACloud as a Subject
    • BCloud as a Tool
    • CCloud as an Audit
    • DCloud as an Object

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    I think ti is A Cloud as a subject It refers to a crime in which the attackers attempt to compromise the security of a cloud environment to steal data or inject malware. Example: Stealing the identity of a cloud user, unauthorized modification or deletion of stored data, and installation of malware on the cloud. ▪ Cloud as an object In this type of crime, attackers use a cloud system to commit a crime against the CSP; here, the cloud behaves like an object. In this case, the main objective of the attacker is to impact the CSP instead of the cloud environment. Example: DDoS attacks over the cloud that can cause failure in the entire cloud environment. ▪ Cloud as a tool The cloud becomes a tool when the attacker uses a compromised cloud account to attack other accounts. In such cases, both the source and target cloud can store the evidence data. Example: Using a cloud to perform an attack on other clouds or when a crime-related evidence is saved and shared in the cloud

    Adapted from community discussion by MrRubi · 2024-08-03 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

    1. M

       MrRubi

       2024-08-03

       Selected A2 upvotes

       I think ti is A Cloud as a subject It refers to a crime in which the attackers attempt to compromise the security of a cloud environment to steal data or inject malware. Example: Stealing the identity of a cloud user, unauthorized modification or deletion of stored data, and installation of malware on the cloud. ▪ Cloud as an object In this type of crime, attackers use a cloud system to commit a crime against the CSP; here, the cloud behaves like an object. In this case, the main objective of the attacker is to impact the CSP instead of the cloud environment. Example: DDoS attacks over the cloud that can cause failure in the entire cloud environment. ▪ Cloud as a tool The cloud becomes a tool when the attacker uses a compromised cloud account to attack other accounts. In such cases, both the source and target cloud can store the evidence data. Example: Using a cloud to perform an attack on other clouds or when a crime-related evidence is saved and shared in the cloud

    2. T

       Thinkthrough

       2023-10-22

       1 upvote

       I think D is correct. Cloud as a subject: It refers to a crime in which the attackers try to compromise the security of a cloud environment to steal data or inject a malware Cloud as an object: when the attacker uses the cloud to commit a crime targeted towards the CSP.

20. Question 20 of 25

    Randy has extracted data from an old version of a Windows-based system and discovered info file Dc5.txt in the system recycle bin. What does the file name denote?

    • AA text file deleted from C drive in sixth sequential order
    • BA text file deleted from C drive in fifth sequential order
    • CA text file copied from D drive to C drive in fifth sequential order
    • DA text file copied from C drive to D drive in fifth sequential order

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    Page 348 of CHFI e-Book: The Windows Vista and later versions renames the files stored in the Recycle Bin as $Ry.ext, whereas in older versions of Windows, it used be Dxy.ext. In this naming process, “x” represents the drive name, “y” a sequential number starting from 0, and “.ext” being the original file’s extension such as .doc, .docx, .pdf, etc. And the 3 examples on Page 349 also supported. However, I noted that near the end of Page 348, they also mentioned starting from 0. Will need EC-Council to verify.

    Adapted from community discussion by Ripley522 · 2021-06-28 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

    1. R

       Ripley522

       2021-06-28

       2 upvotes

       Page 348 of CHFI e-Book: The Windows Vista and later versions renames the files stored in the Recycle Bin as $Ry.ext, whereas in older versions of Windows, it used be Dxy.ext. In this naming process, “x” represents the drive name, “y” a sequential number starting from 0, and “.ext” being the original file’s extension such as .doc, .docx, .pdf, etc. And the 3 examples on Page 349 also supported. However, I noted that near the end of Page 348, they also mentioned starting from 0. Will need EC-Council to verify.

    2. C

       Ceh2024

       2024-09-05

       Selected B1 upvote

       For example, in the case of a Dxy.ext file in the Recycled folder, “x” denotes the name of drive such as “C,” “D,” and others; “y” denotes the sequential number starting from one; and “ext” is the extension of the original file. Computer Hacking Forensics Investigator (CHFI) Version 10 EC-Council Pg. 431

21. Question 21 of 25

    Which layer of iOS architecture should a forensics investigator evaluate to analyze services such as Threading, File Access, Preferences, Networking and high- level features?

    • ACore Services
    • BMedia services
    • CCocoa Touch
    • DCore OS

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    The Core Services layer provides an abstraction over the services provided in the Core OS layer. It provides fundamental access to iOS services and consists of the following components: Collections Address Book Networking File Access SQLite Core Location Net Services Threading Preferences URL Utilities

    Adapted from community discussion by stickerbush1970 · 2022-02-17 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

    1. S

       stickerbush1970

       2022-02-17

       3 upvotes

       The Core Services layer provides an abstraction over the services provided in the Core OS layer. It provides fundamental access to iOS services and consists of the following components: Collections Address Book Networking File Access SQLite Core Location Net Services Threading Preferences URL Utilities

    2. C

       Ceh2024

       2024-09-01

       Selected A1 upvote

       Core service Layer :Threading, File Access, Preferences, Collections (NSArray, NSDictionary, NSSet), Networking, Address Book, and High Level Features (iCloud, In-App Purchase, and SQLite. Computer Hacking Forensics Investigator (CHFI) Version 10 EC-Council Pg. 1441

22. Question 22 of 25

    Pick the statement which does not belong to the Rule 804. Hearsay Exceptions; Declarant Unavailable.

    • AStatement of personal or family history
    • BPrior statement by witness
    • CStatement against interest
    • DStatement under belief of impending death

    Show answer

    Correct answer: D

    Explanation

    The four traditional exceptions requiring proof of unavailability are: a) 804 (b) (1) -- Former testimony. b) 804 (b) (2) -- Statements made under belief of impending death, known everywhere by its common law name: Dying Declarations. c) 804 (b) (3) -- Statements against interest d) 804 (b) (4) -- Statements of personal or family history With these few points, the correct answer should be B Reference: https://law.indiana.edu/instruction/tanford/b723/18unavail/T18.pdf

    Adapted from community discussion by Cytrail · 2024-09-18 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

    1. C

       Cytrail

       2024-09-18

       3 upvotes

       The four traditional exceptions requiring proof of unavailability are: a) 804 (b) (1) -- Former testimony. b) 804 (b) (2) -- Statements made under belief of impending death, known everywhere by its common law name: Dying Declarations. c) 804 (b) (3) -- Statements against interest d) 804 (b) (4) -- Statements of personal or family history With these few points, the correct answer should be B Reference: https://law.indiana.edu/instruction/tanford/b723/18unavail/T18.pdf

    2. D

       deadguy1000

       2024-07-28

       1 upvote

       https://www.law.cornell.edu/rules/fre/rule_804#:~:text=Rule%20804%20defines%20what%20hearsay,is%20unavailable%20as%20a%20witness.&text=The%20House%20bill%20provides%20in,process%20or%20other%20reasonable%20means.

    3. D

       deadguy1000

       2024-07-28

       1 upvote

       The Exceptions. The following are not excluded by the rule against hearsay if the declarant is unavailable as a witness:

23. Question 23 of 25

    During an investigation of an XSS attack, the investigator comes across the term "[a-zA-Z0-9\%]+" in analyzed evidence details. What is the expression used for?

    • AChecks for upper and lower-case alphanumeric string inside the tag, or its hex representation
    • BChecks for forward slash used in HTML closing tags, its hex or double-encoded hex equivalent
    • CChecks for opening angle bracket, its hex or double-encoded hex equivalent
    • DChecks for closing angle bracket, hex or double-encoded hex equivalent

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    [a-zA-Z0-9]+ is a pattern that matches against a string of any length, as long as the string contains only lowercase letters (a-z), uppercase letters (A-Z), or numerals (0-9).

    Adapted from community discussion by Selzar · 2021-11-17 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

    1. S

       Selzar

       2021-11-17

       7 upvotes

       [a-zA-Z0-9]+ is a pattern that matches against a string of any length, as long as the string contains only lowercase letters (a-z), uppercase letters (A-Z), or numerals (0-9).

    2. C

       Ceh2024

       2024-09-02

       Selected A1 upvote

       [a-zA-Z0-9\%]+: It searches for upper and lower-case alphanumeric strings inside the tag, or their hex equivalent. Computer Hacking Forensics Investigator (CHFI) Version 10 EC-Council Pg.972

24. Question 24 of 25

    Centralized binary logging is a process in which many websites write binary and unformatted log data to a single log file. What extension should the investigator look to find its log file?

    • A.cbl
    • B.log
    • C.ibl
    • D.txt

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    Centralized binary logging is a server session property that, when enabled, configures logging for all of the URL groups under the server session. When centralized binary logging is enabled, data cannot be recorded or formatted for individual URL groups. The centralized binary logging log file has an Internet binary log (.ibl) file name extension. This file name extension ensures that text utilities do not try to open and read the central binary logging log file.

    Adapted from community discussion by BowerCarl · 2022-01-11 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn

    View community discussion3

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

    1. B

       BowerCarl

       2022-01-11

       4 upvotes

       Centralized binary logging is a server session property that, when enabled, configures logging for all of the URL groups under the server session. When centralized binary logging is enabled, data cannot be recorded or formatted for individual URL groups. The centralized binary logging log file has an Internet binary log (.ibl) file name extension. This file name extension ensures that text utilities do not try to open and read the central binary logging log file.

    2. S

       sandman310323

       2022-02-27

       2 upvotes

       all websites present on the server send log data to the central log file. Its log file has an Internet binary log (.ibl) file name extension.

    3. C

       Ceh2024

       2024-09-02

       Selected C1 upvote

       Ref https://learn.microsoft.com/en-us/windows/win32/http/centralized-binary-logging

25. Question 25 of 25

    For what purpose do the investigators use tools like iPhoneBrowser, iFunBox, OpenSSHSSH, and iMazing?

    • ABypassing iPhone passcode
    • BDebugging iPhone
    • CRooting iPhone
    • DCopying contents of iPhone

    Show answer

    Correct answer: A

    Explanation

    I think A is correct, book said: Title of the slide: "Bypassing the iPhone Passcode Using IExplorer", in footer: In addition to this, tools like iPhoneBrowser, iFunBox, OpenSSHSSH and iMazing also help in bypassing the passcode

    Adapted from community discussion by alvaroestebancta · 2024-06-21 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-49 or CertExamHQ.

    1. A

       alvaroestebancta

       2024-06-21

       6 upvotes

       I think A is correct, book said: Title of the slide: "Bypassing the iPhone Passcode Using IExplorer", in footer: In addition to this, tools like iPhoneBrowser, iFunBox, OpenSSHSSH and iMazing also help in bypassing the passcode

    2. B

       Bodescu

       2024-11-07

       3 upvotes

       Module 13, page 1312: " tools like iPhoneBrowser, iFunBox, OpenSSHSSH and iMazing also help in bypassing the passcode". Answer is A

    3. M

       maikonalmeida

       2024-02-04

       2 upvotes

       correct is D IfunBox: the File and App Management Tool for iPhone, iPad & iPod Touch.It's available on Windows and Mac OSX IphoneBrowser is the same..

    4. F

       Fabsauro

       2024-10-19

       1 upvote

       I´m totally sure that are file manegers. So letter D is the right answer. No question about it. Google the names.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

312-49 practice, question 1 of 25