CertArea
All EC-Council exams

Free Computer Hacking Forensic Investigator (CHFI) practice test: 30 questions with answers

30 original questions for Computer Hacking Forensic Investigator (CHFI), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions

Computer Hacking Forensic Investigator (CHFI) exam guide: topics, cost and format

All 30 Computer Hacking Forensic Investigator (CHFI) questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Forensic Process and Evidence Handling (3 questions)

  1. Question 1

    An investigator is asked to seize a running computer that holds volatile evidence. Which step should be taken first?

    1. AShut the computer down immediately so that the disk can be imaged without any further changes
    2. BCapture the volatile data, such as memory and network connections, before shutting the system down
    3. CLog in to the computer and browse its files to decide which evidence is worth collecting
    4. DUnplug the power cable from the wall socket so that the system stops at once without any delay
    Show answer and explanation
    Correct answer: B

    Volatile data such as RAM and live connections disappears when the system is powered off, so it must be captured first. Shutting down, logging in or pulling the plug each destroys volatile evidence.

  2. Question 2

    What is the purpose of a chain of custody record in a digital forensic investigation?

    1. AIt stores the suspect's personal photographs so that they can be compared with the evidence later
    2. BIt lists the software tools that the investigator prefers to use for analysis of each case
    3. CIt records the investigator's working hours so that the fees charged to the client are justified
    4. DIt documents who handled each item of evidence, when, and for what purpose, from seizure onward
    Show answer and explanation
    Correct answer: D

    The chain of custody documents each handler, time and purpose, which supports the evidence's integrity and admissibility. Tool preferences, working hours and personal photographs are not its purpose.

  3. Question 3

    Which action best demonstrates that a forensic disk image is an exact copy of the original drive?

    1. AComparing cryptographic hash values of the original and the image, which must match exactly
    2. BChecking that the image file has a similar size to the original drive and a plausible name
    3. COpening several files from the image to confirm that they look the same as on the original
    4. DAsking the suspect to confirm that the copy looks the same as the original drive they used
    Show answer and explanation
    Correct answer: A

    Matching cryptographic hashes prove the image is bit-for-bit identical to the original. Size, a few opened files and the suspect's opinion do not prove that.

Disk Forensics and File Systems (3 questions)

  1. Question 4

    Which type of data is stored in the unallocated space of a disk and may contain deleted files?

    1. AThe firmware code of the disk controller that is stored permanently in its chip
    2. BFiles that are currently open by the operating system in the foreground of the desktop
    3. CRemnants of files that were deleted but whose clusters have not yet been overwritten
    4. DThe temporary files that the browser writes to memory and never to the disk at all
    Show answer and explanation
    Correct answer: C

    Unallocated space holds remnants of deleted files until their clusters are overwritten, which makes it valuable for recovery. Open files, controller firmware and memory-only data are not in unallocated space.

  2. Question 5

    Which artefact in Windows records the most recently executed programs, which can help show what ran on a system?

    1. AThe desktop wallpaper setting, which changes whenever the user opens the control panel
    2. BPrefetch files and the Amcache or Shimcache artefacts, which record program execution
    3. CThe printer driver list, which shows the printers that have been installed on the machine
    4. DThe screen resolution setting, which the operating system stores in the user's profile folder
    Show answer and explanation
    Correct answer: B

    Prefetch, Amcache and Shimcache record evidence of program execution, which helps reconstruct activity. Wallpaper, printer drivers and screen resolution do not record execution.

  3. Question 6

    What does file slack space refer to in a forensic examination?

    1. AThe amount of free memory available on a server while it is running normal workloads
    2. BThe space on a USB drive reserved for the operating system's update files by the manufacturer
    3. CThe empty area of the desktop where icons have not been placed by the user at all
    4. DThe unused portion of the last cluster allocated to a file, which can hold residual data
    Show answer and explanation
    Correct answer: D

    File slack is the unused part of a file's last cluster, which can contain residual data from earlier files. The other options describe unrelated storage or memory concepts.

Network Forensics (3 questions)

  1. Question 7

    Which tool captures network packets for later analysis, which is the basis of many network investigations?

    1. AA spreadsheet that lists the IP addresses of the office printers for quick reference
    2. BA word processor that writes the investigation report in a plain format for the client
    3. CA packet capture tool that records traffic for detailed analysis after it has been collected
    4. DA calendar tool that schedules the investigator's interviews with the staff in the building
    Show answer and explanation
    Correct answer: C

    Packet capture records traffic for detailed analysis, which is the foundation of network forensics. The other tools do not capture network traffic.

  2. Question 8

    What information does a firewall or proxy log most typically provide to a network investigator?

    1. AThe full text of every email message that passed through the network during the period
    2. BSource and destination addresses, ports, timestamps and whether traffic was allowed or blocked
    3. CThe contents of every encrypted file that was transferred between internal hosts without decryption
    4. DThe biometric data of each user who logged on to the network at the perimeter during the day
    Show answer and explanation
    Correct answer: B

    Firewall and proxy logs typically provide addresses, ports, timestamps and allow or block decisions. Message contents, encrypted file contents and biometric data are not normally logged there.

  3. Question 9

    Which THREE data sources help reconstruct a network intrusion? (Choose three.)

    1. AFirewall and proxy logs showing connections and their outcomes
    2. BEndpoint logs showing processes and authentication events on the affected hosts
    3. CDHCP and DNS logs that map addresses and name lookups to hosts over time
    4. DThe office printer's toner usage history, which records the ink levels each week
    5. EThe staff holiday calendar, which shows which employees were away on each date
    Show answer and explanation
    Correct answer: A, B, C

    Firewall and proxy logs, endpoint logs and DHCP and DNS logs reconstruct connections, activity and address mappings. Toner history and holiday calendars are not intrusion evidence.

Windows Forensics (3 questions)

  1. Question 10

    Which Windows log records successful and failed logon attempts, which is useful for tracing account use?

    1. AThe Setup log, which records the progress of Windows installation and updates only
    2. BThe Application log, which records events generated by the installed software packages
    3. CThe Security event log, which records logon events and account activity
    4. DThe Print Service log, which records each document sent to a printer on the network
    Show answer and explanation
    Correct answer: C

    The Security event log records logon successes and failures and account activity, which is central to tracing account use. The other logs record software, installation and printing.

  2. Question 11

    Which Windows artefact records the user's recently opened files and folders, which can show what a user accessed?

    1. AJump lists and LNK files, which record recently accessed files and applications
    2. BThe BIOS settings, which record the clock time and the hardware configuration of the device
    3. CThe power plan, which controls how the computer sleeps when it is left idle for a time
    4. DThe screen saver image, which is stored in the user's profile without any usage records
    Show answer and explanation
    Correct answer: A

    Jump lists and LNK files record recently accessed files and applications, which helps show user activity. BIOS settings, power plans and screen savers do not track file access.

  3. Question 12

    Which registry key holds evidence of USB storage devices that have been connected to a Windows system?

    1. AThe wallpaper key under the current user's control panel, which stores the desktop image path
    2. BThe USBSTOR and USB enumeration keys under the SYSTEM hive, which record device connections
    3. CThe keyboard layout key under the default user profile, which stores the input language
    4. DThe screen saver key under the current user's control panel, which stores the timeout value
    Show answer and explanation
    Correct answer: B

    The USBSTOR and USB enumeration keys in the SYSTEM hive record connected USB storage devices. Wallpaper, keyboard and screen saver keys do not record device connections.

Malware Forensics (3 questions)

  1. Question 13

    During malware analysis, which technique involves examining the code without running it?

    1. ADynamic analysis, which runs the sample and observes its behaviour on a monitored system
    2. BStatic analysis, which examines the sample's code and strings without executing it
    3. CLive response, which collects data from a running system to understand its current state
    4. DNetwork replay, which sends the captured traffic back to the network to see the effect
    Show answer and explanation
    Correct answer: B

    Static analysis examines code and strings without execution. Dynamic analysis, live response and network replay all involve running or interacting with the malware or system.

  2. Question 14

    During malware analysis, what does the term persistence refer to?

    1. ATechniques the malware uses to remain active across reboots, such as run keys or scheduled tasks
    2. BThe malware's ability to keep the same name across every version of the file that it creates
    3. CThe number of times the malware sample was copied by the analyst during the examination
    4. DThe length of time that the analysis lab keeps the sample before it is deleted
    Show answer and explanation
    Correct answer: A

    Persistence refers to techniques such as run keys, services or scheduled tasks that let malware survive reboots. Naming, copy counts and retention periods are unrelated.

  3. Question 15

    Which indicator would most strongly suggest that a document contains a malicious macro?

    1. AA document that was last saved on a Monday by a user who usually works on Mondays
    2. BA document that contains a company logo in the header of each page as a standard design
    3. CA document with a signature block at the end that identifies the author by name and role
    4. DAn automatic macro that runs on open and downloads an executable from an external address
    Show answer and explanation
    Correct answer: D

    Automatic macros that run on open and download executables from external addresses are a strong sign of malicious content. Logos, signatures and save days are normal.

Email Forensics (3 questions)

  1. Question 16

    Which part of an email message is most useful for tracing the path the message took across mail servers?

    1. AThe message headers, which record each server that handled the message in order
    2. BThe signature block at the bottom of the message, which shows the sender's job title
    3. CThe emoji used in the subject line, which indicates the sender's mood at the time
    4. DThe font used in the body of the message, which shows the client's preferred settings
    Show answer and explanation
    Correct answer: A

    Message headers record the servers that handled the message in order, which shows its path. Signatures, emoji and fonts do not show routing.

  2. Question 17

    An investigator must determine whether an email was forged. Which evidence is the most useful?

    1. AAuthentication results and the server path shown in the headers, compared with the claimed sender
    2. BThe number of recipients on the message and the length of the subject line in characters
    3. CThe date on the sender's calendar on the day of the message and the time zone set on it
    4. DThe colour of the email client theme that the sender was using when they wrote the message
    Show answer and explanation
    Correct answer: A

    Authentication results and the server path in headers, compared with the claimed sender, show whether the message is genuine. Recipient counts, calendars and theme colours do not establish authenticity.

  3. Question 18

    Which email header field most often identifies the mail client or application that sent the message?

    1. AThe To header, which lists the people who are the intended recipients of the message
    2. BThe X-Mailer or User-Agent header, which can name the client software used to send the message
    3. CThe Subject header, which holds the text that appears on the inbox list for the recipient
    4. DThe Content-Type header, which states whether the body of the message is plain text or HTML
    Show answer and explanation
    Correct answer: B

    The X-Mailer or User-Agent header can identify the sending client. The To, Subject and Content-Type headers describe recipients, subject text and body format.

Forensic Reporting and Testimony (3 questions)

  1. Question 19

    What should a forensic report include so that its findings can be reviewed and reproduced by another examiner?

    1. AThe investigator's personal opinions about the suspect's character and likely motives in the case
    2. BOnly the investigator's final conclusion, with no description of the steps, tools or evidence used
    3. CThe methods, tools and versions used, the evidence hashes, and the steps taken to reach each finding
    4. DA list of the investigator's previous cases, unrelated to the matter being investigated in the report
    Show answer and explanation
    Correct answer: C

    A reproducible report records methods, tool versions, evidence hashes and steps, which lets another examiner verify the findings. Conclusions alone, personal opinions and unrelated cases do not support review.

  2. Question 20

    Why should an examiner distinguish between facts and opinions in a forensic report?

    1. ABecause facts are not allowed to appear in any forensic report according to the standard guidance
    2. BBecause opinions are always more accurate than facts and should therefore replace the factual findings
    3. CBecause the report is read only by the examiner who wrote it and no one else will see it
    4. DBecause courts weigh verifiable facts more heavily, and opinions must be clearly labelled as the examiner's interpretation
    Show answer and explanation
    Correct answer: D

    Clear separation lets readers weigh verifiable facts appropriately and understand which statements are interpretation. The other reasons are incorrect.

  3. Question 21

    What is the most important quality of an expert witness giving testimony about digital evidence?

    1. AEagerness to answer questions about unrelated cases that the examiner worked on in the past
    2. BFriendliness toward the defence team, so that the court sees that the examiner is pleasant
    3. CConfidence in every answer, even when the evidence does not support a firm conclusion
    4. DObjectivity, accuracy and the ability to explain technical findings clearly to a non-technical audience
    Show answer and explanation
    Correct answer: D

    Objectivity, accuracy and clear explanation are the core qualities of an expert witness. Friendliness, unwarranted confidence and unrelated cases do not serve the court.

Mobile Forensics (3 questions)

  1. Question 22

    Which mobile forensic approach collects the most complete data from a device, including deleted content, when the device and its security allow it?

    1. AA printout of the device's home screen, showing only the icons that are visible
    2. BA manual screenshot of each screen that the user reads aloud during the interview
    3. CA physical extraction that reads the device's storage at the lowest level
    4. DA copy of the user's public social media profile, which is always identical to the device
    Show answer and explanation
    Correct answer: C

    Physical extraction reads storage at a low level and can recover deleted data where possible. Screenshots, home screen printouts and public profiles provide far less.

  2. Question 23

    What is the main reason that mobile devices present challenges for forensic acquisition?

    1. AMobile devices always use paper records for their messages, which must be scanned instead
    2. BMobile devices never store any data on their internal storage, so there is nothing to acquire
    3. CEncryption, locked devices and frequent app changes can limit access to data
    4. DMobile devices are always stored in evidence bags that prevent any data from being read
    Show answer and explanation
    Correct answer: C

    Encryption, locks and frequent app changes can limit access and complicate acquisition. Mobile devices do store data, and they do not rely on paper records.

  3. Question 24

    Why should an investigator keep a seized mobile phone isolated from networks?

    1. ATo prevent remote wiping or changes to data that would destroy or alter evidence
    2. BTo make the phone's battery last longer while it is held in the evidence store
    3. CTo stop the phone from being charged, which would keep its data in a locked state
    4. DTo prevent the phone's camera from taking any photographs of the investigator's workspace
    Show answer and explanation
    Correct answer: A

    Isolation through a Faraday bag or similar prevents remote wiping and changes that would destroy evidence. Battery life, charging and camera use are not the concern.

Cloud Forensics (2 questions)

  1. Question 25

    What is the main challenge when investigating evidence in a cloud environment?

    1. ACloud evidence is always stored on paper printouts that are difficult to obtain from the provider
    2. BEvidence is distributed across provider infrastructure and access depends on the provider's logs and cooperation
    3. CCloud providers never keep any logs, so no evidence can be obtained from them under any circumstances
    4. DCloud environments are always physically located in the investigator's own office building
    Show answer and explanation
    Correct answer: B

    Cloud evidence is distributed, often held by the provider, and depends on available logs and access arrangements. The other statements are inaccurate.

  2. Question 26

    Which cloud evidence source records administrative actions performed on the cloud account, such as creating or deleting resources?

    1. AControl plane audit logs maintained by the cloud provider for the account
    2. BPhysical access logs for the provider's data centre, which record staff badge entries
    3. CPrinter logs in the customer's office, which record the documents printed each day
    4. DBrowser extensions installed on the investigator's own laptop for research purposes only
    Show answer and explanation
    Correct answer: A

    Control plane audit logs record administrative actions on the account and are a primary cloud evidence source. Data centre badge logs, office printers and an investigator's extensions do not record account administration.

Anti-Forensics (2 questions)

  1. Question 27

    What does the term anti-forensics describe?

    1. ATechniques that attempt to hinder or defeat digital forensic investigation, such as wiping or tampering with evidence
    2. BTechniques that improve the quality of a digital forensic investigation by adding more logs to the system
    3. CTools that help a forensic examiner recover data from damaged drives in a laboratory setting
    4. DMethods for backing up a company's data to remote storage so that it can be restored quickly
    Show answer and explanation
    Correct answer: A

    Anti-forensics refers to techniques that hinder investigation, including wiping, tampering and obfuscation. The other options describe forensic support or backup, not hindrance.

  2. Question 28

    Which indicator suggests that timestamps on files may have been altered to hide activity?

    1. AFiles whose modified time is the same as their created time because they were not changed
    2. BTimestamps that match the time the forensic image was created during the examination
    3. CInconsistencies between file system timestamps and independent logs or artefacts of the same events
    4. DFiles that carry a time zone label in their metadata, which is normal for many applications
    Show answer and explanation
    Correct answer: C

    Inconsistencies between file timestamps and independent logs or artefacts suggest manipulation. Matching times, unchanged files and time zone labels are normal characteristics.

Linux Forensics (2 questions)

  1. Question 29

    Which Linux log file records authentication events such as successful and failed logins on many distributions?

    1. AThe cron configuration file, which lists the scheduled jobs that run on the system
    2. BThe kernel ring buffer, which records only the hardware events that occur during boot
    3. CThe auth log, which records authentication events such as logins and sudo use
    4. DThe package cache, which stores the downloaded installation files for software updates
    Show answer and explanation
    Correct answer: C

    The auth log records authentication activity such as logins and sudo use on many Linux distributions. The kernel buffer, cron configuration and package cache record other things.

  2. Question 30

    Which Linux artefact records the commands typed by a user in a terminal session?

    1. AThe cron configuration, which lists the scheduled jobs that run automatically on the system
    2. BThe kernel log, which records hardware events and driver messages during the boot sequence
    3. CThe system package list, which records the software installed through the package manager
    4. DThe shell history file in the user's home directory, such as bash history
    Show answer and explanation
    Correct answer: D

    Shell history files record commands typed by the user, subject to configuration. Kernel logs, package lists and cron configurations record other system activity.