CHFI study guide Questions with 100%
Correct Verified Answers
Which command displays the network configuration of the NICs on the system? -
✅ipconfig /all
Which of the following is a Linux journaling file system: Ext3, HFS, FAT, or BFS? - ✅Ext3
which steganography types hides the secret message pattern on the document that is unclear
to the average reader? - ✅Open code steganography
Which table is used to convert huge word lists into password hashes? - ✅Rainbow tables
Which communication standard is used in serial communication data acquisition system? -
✅RS232
What approach checks and compares all the fields systematically and intentionally for
positive and negative correlation with each other to determine the correlation across one or
multiple fields? - ✅Automated field correlation approach
Attackers can manipulate variables that reference files with "dot-dot-slash (./)"
identity the attack referred - ✅Directory traversal
, The electronic serial number (ESN) is a unique _______ bit identifier recorded on a secure chip
in a mobile phone by the manufacturer. - ✅32-bit identifier
Who is responsible for collecting, preserving, and packaging electronic evidence? -
✅Forensic Laboratory staff
which task list command provides information about the listed processes, including the
image name, PID, name, and number of the session for the process? - ✅tasklist/V
What does event ID 531 in Windows security event logs indicate? - ✅A logon attempt
was made with a disabled account.
When collecting evidence from the RAM, where do you look for data? - ✅Swap file
The source, nature, and time of the attack can be determined by analyzing what on a
compromised system? - ✅log files
how many bytes are on a sector on a hard disk? - ✅512 bytes
What is chain of custody? - ✅A legal document that demonstrates progression of evidence
as it travels from original evidence to the forensic laboratory
Which RAID level has distributed parity? - ✅RAID level 5
Email spoofing refers to: - ✅The forgery of an email header so that the message appears
to have originated from someone or somewhere other than the actual source.
Which device in a wireless local area network (WLAN) determines the next network point
to which a packet should be forwarded toward its destination? - ✅Wireless router
Correct Verified Answers
Which command displays the network configuration of the NICs on the system? -
✅ipconfig /all
Which of the following is a Linux journaling file system: Ext3, HFS, FAT, or BFS? - ✅Ext3
which steganography types hides the secret message pattern on the document that is unclear
to the average reader? - ✅Open code steganography
Which table is used to convert huge word lists into password hashes? - ✅Rainbow tables
Which communication standard is used in serial communication data acquisition system? -
✅RS232
What approach checks and compares all the fields systematically and intentionally for
positive and negative correlation with each other to determine the correlation across one or
multiple fields? - ✅Automated field correlation approach
Attackers can manipulate variables that reference files with "dot-dot-slash (./)"
identity the attack referred - ✅Directory traversal
, The electronic serial number (ESN) is a unique _______ bit identifier recorded on a secure chip
in a mobile phone by the manufacturer. - ✅32-bit identifier
Who is responsible for collecting, preserving, and packaging electronic evidence? -
✅Forensic Laboratory staff
which task list command provides information about the listed processes, including the
image name, PID, name, and number of the session for the process? - ✅tasklist/V
What does event ID 531 in Windows security event logs indicate? - ✅A logon attempt
was made with a disabled account.
When collecting evidence from the RAM, where do you look for data? - ✅Swap file
The source, nature, and time of the attack can be determined by analyzing what on a
compromised system? - ✅log files
how many bytes are on a sector on a hard disk? - ✅512 bytes
What is chain of custody? - ✅A legal document that demonstrates progression of evidence
as it travels from original evidence to the forensic laboratory
Which RAID level has distributed parity? - ✅RAID level 5
Email spoofing refers to: - ✅The forgery of an email header so that the message appears
to have originated from someone or somewhere other than the actual source.
Which device in a wireless local area network (WLAN) determines the next network point
to which a packet should be forwarded toward its destination? - ✅Wireless router
