Certified Hacking Forensic Investigator (CHFI) -
Exam Quizz Bank | 3150 Questions with 100%
Correct Verified Answers| Latest Update 2024
What command can be used to view command history? - ✅doskey /history & scroll up in
the command window
(If a command window is open, the investigator can scroll up to see command history. But
the attacker may have typed cls to clear the screen. Then, the investigator can use the doskey
/history command to see the history.)
What are two registry settings that could impact a forensic analysis and investigation? -
✅ClearPageFileAtShutdown & DisableLastAccess
(* ClearPageFileAtShutdown - tells the OS to clear the page file when the system is shut
down. This will clear virtual memory in the swap file. * DisableLastAccess - disables updating
of the last access times on files so the timestamp might not be accurate)
What are two registry settings that could impact a forensic analysis and investigation? -
✅ClearPageFileAtShutdown & DisableLastAccess
(* ClearPageFileAtShutdown - tells the OS to clear the page file when the system is shut
down. This will clear virtual memory in the swap file. * DisableLastAccess - disables updating
of the last access times on files so the timestamp might not be accurate)
What is the Index.dat file used for? - ✅AutoComplete & Redundant information such
as visited URLs, search queries, recently opened files
(* Index.dat is used for redundant information such as AutoComplete information. *
Index.dat can be found in the History folder for Internet Explorer)
What is the Index.dat file used for? - ✅AutoComplete & Redundant information such
as visited URLs, search queries, recently opened files
,(* Index.dat is used for redundant information such as AutoComplete information. *
Index.dat can be found in the History folder for Internet Explorer)
Which of the following is true about the swap file? - ✅Hidden file in the root directory called
pagefile.sys & Registry path is
HKEY_LOCAL_MACHINE_SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management
(The swap file can be organized as a contiguous space so fewer I/O operations are required
to read and write. It is a hidden file in the root directory called pagefile.sys.)
Which of the following is true about the swap file? - ✅Hidden file in the root directory called
pagefile.sys & Registry path is
HKEY_LOCAL_MACHINE_SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management
(The swap file can be organized as a contiguous space so fewer I/O operations are required to
read and write. It is a hidden file in the root directory called pagefile.sys.)
Each process of Windows is represented as an _______. - ✅Executive process
(Each process on a Windows system is represented as an executive process or EProcess.
EProcess block is a data structure containing attributes of the process and pointers to threads
and process environment blocks.)
Each process of Windows is represented as an _______. - ✅Executive process
(Each process on a Windows system is represented as an executive process or EProcess.
EProcess block is a data structure containing attributes of the process and pointers to threads
and process environment blocks.)
What command is used to view EProcess block? - ✅dt -a -b -v _EPROCESS
What command is used to view EProcess block? - ✅dt -a -b -v _EPROCESS
,What is the most important element of EProcess? - ✅PEB - Process Environment Block
What is the most important element of EProcess? - ✅PEB - Process Environment Block
What are the six stages of process creation? - ✅1. Launch .exe: File Execution Options
registry key is checked for debugger value. If yes, process starts over
EProcess object created along with KProcess, PEB, and initial address space
Initial thread created
Windows subsystem is notified of new process and thread
Execution of initial thread starts
Initialization of address space is complete for new process and thread
What are the six stages of process creation? - ✅1. Launch .exe: File Execution Options
registry key is checked for debugger value. If yes, process starts over
EProcess object created along with KProcess, PEB, and initial address space
Initial thread created
Windows subsystem is notified of new process and thread
Execution of initial thread starts
Initialization of address space is complete for new process and thread
True or False: The EProcess object is created along with KProcess, PEB, and initial address
space - ✅True
True or False: The EProcess object is created along with KProcess, PEB, and initial address
space - ✅True
What tool can parse memory? - ✅Lsproc.pl d:\dumps\test-mem.dmp
, What tool can parse memory? - ✅Lsproc.pl d:\dumps\test-mem.dmp
What is an important consideration for complete memory dump analysis? - ✅Pagefile.sys
(The swap file, called pagefile.sys, is virtual memory. Information in the swapfile must also be
considered when analyzing memory.)
What is an important consideration for complete memory dump analysis? - ✅Pagefile.sys
(The swap file, called pagefile.sys, is virtual memory. Information in the swapfile must also be
considered when analyzing memory.)
What files contain pool headers? - ✅Pooltag.txt
(Windows memory manager generally allocates memory in 4KB pages. Sometimes, 4K would be
too large and waste memory. So memory manager allocates several pages ahead of time thus
keeping an available pool of memory.)
What files contain pool headers? - ✅Pooltag.txt
(Windows memory manager generally allocates memory in 4KB pages. Sometimes, 4K would be
too large and waste memory. So memory manager allocates several pages ahead of time thus
keeping an available pool of memory.)
What is the advantage of PMDump? - ✅Dump contents of process memory without
stopping the process
What is the advantage of PMDump? - ✅Dump contents of process memory without
stopping the process
What does HKEY_CURRENT_USER contain? - ✅Active, loaded user profile for currently
logged-on user
Exam Quizz Bank | 3150 Questions with 100%
Correct Verified Answers| Latest Update 2024
What command can be used to view command history? - ✅doskey /history & scroll up in
the command window
(If a command window is open, the investigator can scroll up to see command history. But
the attacker may have typed cls to clear the screen. Then, the investigator can use the doskey
/history command to see the history.)
What are two registry settings that could impact a forensic analysis and investigation? -
✅ClearPageFileAtShutdown & DisableLastAccess
(* ClearPageFileAtShutdown - tells the OS to clear the page file when the system is shut
down. This will clear virtual memory in the swap file. * DisableLastAccess - disables updating
of the last access times on files so the timestamp might not be accurate)
What are two registry settings that could impact a forensic analysis and investigation? -
✅ClearPageFileAtShutdown & DisableLastAccess
(* ClearPageFileAtShutdown - tells the OS to clear the page file when the system is shut
down. This will clear virtual memory in the swap file. * DisableLastAccess - disables updating
of the last access times on files so the timestamp might not be accurate)
What is the Index.dat file used for? - ✅AutoComplete & Redundant information such
as visited URLs, search queries, recently opened files
(* Index.dat is used for redundant information such as AutoComplete information. *
Index.dat can be found in the History folder for Internet Explorer)
What is the Index.dat file used for? - ✅AutoComplete & Redundant information such
as visited URLs, search queries, recently opened files
,(* Index.dat is used for redundant information such as AutoComplete information. *
Index.dat can be found in the History folder for Internet Explorer)
Which of the following is true about the swap file? - ✅Hidden file in the root directory called
pagefile.sys & Registry path is
HKEY_LOCAL_MACHINE_SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management
(The swap file can be organized as a contiguous space so fewer I/O operations are required
to read and write. It is a hidden file in the root directory called pagefile.sys.)
Which of the following is true about the swap file? - ✅Hidden file in the root directory called
pagefile.sys & Registry path is
HKEY_LOCAL_MACHINE_SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management
(The swap file can be organized as a contiguous space so fewer I/O operations are required to
read and write. It is a hidden file in the root directory called pagefile.sys.)
Each process of Windows is represented as an _______. - ✅Executive process
(Each process on a Windows system is represented as an executive process or EProcess.
EProcess block is a data structure containing attributes of the process and pointers to threads
and process environment blocks.)
Each process of Windows is represented as an _______. - ✅Executive process
(Each process on a Windows system is represented as an executive process or EProcess.
EProcess block is a data structure containing attributes of the process and pointers to threads
and process environment blocks.)
What command is used to view EProcess block? - ✅dt -a -b -v _EPROCESS
What command is used to view EProcess block? - ✅dt -a -b -v _EPROCESS
,What is the most important element of EProcess? - ✅PEB - Process Environment Block
What is the most important element of EProcess? - ✅PEB - Process Environment Block
What are the six stages of process creation? - ✅1. Launch .exe: File Execution Options
registry key is checked for debugger value. If yes, process starts over
EProcess object created along with KProcess, PEB, and initial address space
Initial thread created
Windows subsystem is notified of new process and thread
Execution of initial thread starts
Initialization of address space is complete for new process and thread
What are the six stages of process creation? - ✅1. Launch .exe: File Execution Options
registry key is checked for debugger value. If yes, process starts over
EProcess object created along with KProcess, PEB, and initial address space
Initial thread created
Windows subsystem is notified of new process and thread
Execution of initial thread starts
Initialization of address space is complete for new process and thread
True or False: The EProcess object is created along with KProcess, PEB, and initial address
space - ✅True
True or False: The EProcess object is created along with KProcess, PEB, and initial address
space - ✅True
What tool can parse memory? - ✅Lsproc.pl d:\dumps\test-mem.dmp
, What tool can parse memory? - ✅Lsproc.pl d:\dumps\test-mem.dmp
What is an important consideration for complete memory dump analysis? - ✅Pagefile.sys
(The swap file, called pagefile.sys, is virtual memory. Information in the swapfile must also be
considered when analyzing memory.)
What is an important consideration for complete memory dump analysis? - ✅Pagefile.sys
(The swap file, called pagefile.sys, is virtual memory. Information in the swapfile must also be
considered when analyzing memory.)
What files contain pool headers? - ✅Pooltag.txt
(Windows memory manager generally allocates memory in 4KB pages. Sometimes, 4K would be
too large and waste memory. So memory manager allocates several pages ahead of time thus
keeping an available pool of memory.)
What files contain pool headers? - ✅Pooltag.txt
(Windows memory manager generally allocates memory in 4KB pages. Sometimes, 4K would be
too large and waste memory. So memory manager allocates several pages ahead of time thus
keeping an available pool of memory.)
What is the advantage of PMDump? - ✅Dump contents of process memory without
stopping the process
What is the advantage of PMDump? - ✅Dump contents of process memory without
stopping the process
What does HKEY_CURRENT_USER contain? - ✅Active, loaded user profile for currently
logged-on user
