Free CHFI MCQ Questions and Answers — Questions and Answers
Question 1: How many bytes do hard disk sectors normally contain?
- 256
- 512 (Correct answer)
- 2048
- 1024
Correct answer: 512
Hard disk sectors have historically contained 512 bytes of data. While newer 'Advanced Format' drives use 4096-byte (4KB) sectors, they often employ 512-byte sector emulation for compatibility with legacy operating systems and software. Therefore, 512 bytes remains the standard and most commonly encountered sector size in general computer forensics contexts.
Question 2: The following guidelines should be followed when employing an anti-virus scanner for a computer forensics investigation:
- Scan your forensics workstation before beginning investigation (Correct answer)
- Never run a scan on your forensics workstation because it could change your systems configuration
- Scan your forensics workstation at intervals of no more than once every five minutes during an investigation
- Scan the suspect hard drive before beginning an investigation
Correct answer: Scan your forensics workstation before beginning investigation
Before commencing any computer forensics investigation, it is paramount to scan the forensics workstation with an up-to-date anti-virus program. This ensures that the analysis environment itself is clean and free from malware, which could otherwise compromise the integrity of the investigation, alter evidence, or infect the suspect's data. Scanning the suspect drive directly or during the investigation is generally avoided to prevent altering potential evidence.
Question 3: Office suites like Word, Excel, and PowerPoint generate a code for each document that is based on the Media Access Control (MAC) address, also known as the machine's unique identification. What is the name of this code?
- The Globally Unique IDentifrier (GUID) (Correct answer)
- The Personal Application Protocol
- The Microsoft Virtual Machine Identifier
- The Individual ASCII String
Correct answer: The Globally Unique IDentifrier (GUID)
Microsoft Office documents and many other applications embed a Globally Unique IDentifier (GUID) within their metadata. This 128-bit number serves as a unique identifier for the document or object, ensuring its distinctness across various systems and applications. While its generation might involve system-specific information like a MAC address, the resulting unique code is known as the GUID.
Question 4: A _______________ is an attack where the steps in the attack sequence are carried out by a computer program rather than a hacker.
- Blackout attack
- Distributed attack
- Automated attack (Correct answer)
- Central processing attack
Correct answer: Automated attack
An automated attack is a type of cyberattack where the sequence of malicious actions is executed by a computer program, script, or botnet rather than requiring direct, real-time human interaction. These attacks are designed to operate autonomously, often scanning for vulnerabilities, exploiting weaknesses, or distributing malware on a large scale without constant human oversight.
Question 5: In a hexadecimal code, the offset is:
- The Ox at the end of the code
- The Ox at the beginning of the code (Correct answer)
- The first byte after the colon
- The last byte after the colon
Correct answer: The Ox at the beginning of the code
In hexadecimal code, the prefix '0x' is conventionally used to denote that the subsequent characters represent a hexadecimal number. This prefix explicitly indicates the base-16 numbering system, distinguishing it from decimal, binary, or octal representations. Therefore, '0x' marks the beginning of a hexadecimal offset or value.
Question 6: Due to his visits to sexual websites and image downloads, a suspect is accused of abusing computer resources. The goal of the investigation is to show that the suspect actually went to these places. The suspect, however, has deleted the cookie cache and wiped the search history. In addition, he deleted any photographs he may have downloaded. What steps can the investigator take to demonstrate the infraction?
- Image the disk and try to recover deleted files (Correct answer)
- Check the Windows registry for connection data (you may or may not cover)
- Approach the websites for evidence
- Seek the help of co-workers who are eye-witnesses
Correct answer: Image the disk and try to recover deleted files
When files are 'deleted' from a computer, they are often not immediately overwritten; instead, the operating system simply marks the space they occupied as available. A forensic imaging tool creates a bit-for-bit copy of the entire storage device, including this unallocated space. Investigators can then use specialized data recovery software on this image to reconstruct and retrieve these 'deleted' files. This process can uncover evidence like browser history, cookies, and downloaded images, even after a suspect attempts to erase them.
Question 7: Corporate investigations are often simpler than those conducted by the government because:
- The investigator has to get a warrant
- The investigator does not have to get a warrant (Correct answer)
- The users can load whatever they want on their machines
- The users have standard corporate equipment and software
Correct answer: The investigator does not have to get a warrant
Corporate investigations are typically simpler because they operate under different legal frameworks than government investigations. In a corporate setting, employees usually consent to monitoring and searches of company-owned equipment as part of their employment agreement or company policy. This pre-existing consent often negates the need for a search warrant, which is a strict legal requirement for government agencies to seize or search private property.
Free CHFI MCQ Questions and Answers
How many bytes do hard disk sectors normally contain?