CHFI Database Forensics 3

Question 1

Which SQL Server feature, when enabled, records all login attempts including failed ones, and is critical for forensic investigations?

Accepted Answer

SQL Server Audit

Answer

Change Data Capture

Answer

Database Mirroring

Answer

Replication

Question 2

In database forensics, what information can be extracted from the MySQL ibdata1 file?

Accepted Answer

InnoDB tablespace data including deleted records not yet purged

Answer

Only table schemas

Answer

Only index data

Answer

Only stored procedures

Question 3

What forensic technique involves comparing database schema versions to identify unauthorized structural changes?

Accepted Answer

Schema diffing

Answer

Log tailing

Answer

Query profiling

Answer

Index fragmentation analysis

Question 4

Which CHFI-relevant tool is specifically designed to recover and analyze SQLite database files commonly found on mobile devices and applications?

Accepted Answer

DB Browser for SQLite

Answer

FTK Imager

Answer

Wireshark

Answer

Volatility

Question 5

During a forensic investigation, an analyst discovers that SQL Server error log entries have been deleted. Where else might evidence of malicious database activity be found?

Accepted Answer

Windows Event Logs and SQL Server transaction logs

Answer

Only in the application tier

Answer

Only in network packet captures

Answer

Only in firewall logs

Question 6

What is the significance of the SQL Server 'default trace' in a forensic investigation?

Accepted Answer

It captures database object changes, login failures, and DBCC events by default without configuration

Answer

It monitors network bandwidth usage

Answer

It logs all SELECT queries by default

Answer

It monitors CPU usage by queries