Certified Hacking Forensic Investigator (CHFI) - Exam Quizz Bank | 3150 Questions with 100% Correct Verified Answers| Latest Update 2024
3 views 0 purchase
Course
Certified Emergency Nurse-
Institution
Certified Emergency Nurse-
hat command can be used to view command history? - doskey /history & scroll up in
the command window
(If a command window is open, the investigator can scroll up to see command history. But
the attacker may have typed cls to clear the screen. Then, the investigator can use the doskey
/history c...
Certified Hacking Forensic Investigator (CHFI) -
Exam Quizz Bank | 3150 Questions with 100%
Correct Verified Answers| Latest Update 2024
What command can be used to view command history? - ✅doskey /history & scroll up in
the command window
(If a command window is open, the investigator can scroll up to see command history. But
the attacker may have typed cls to clear the screen. Then, the investigator can use the doskey
/history command to see the history.)
What are two registry settings that could impact a forensic analysis and investigation? -
✅ClearPageFileAtShutdown & DisableLastAccess
(* ClearPageFileAtShutdown - tells the OS to clear the page file when the system is shut
down. This will clear virtual memory in the swap file. * DisableLastAccess - disables updating
of the last access times on files so the timestamp might not be accurate)
What are two registry settings that could impact a forensic analysis and investigation? -
✅ClearPageFileAtShutdown & DisableLastAccess
(* ClearPageFileAtShutdown - tells the OS to clear the page file when the system is shut
down. This will clear virtual memory in the swap file. * DisableLastAccess - disables updating
of the last access times on files so the timestamp might not be accurate)
What is the Index.dat file used for? - ✅AutoComplete & Redundant information such
as visited URLs, search queries, recently opened files
(* Index.dat is used for redundant information such as AutoComplete information. *
Index.dat can be found in the History folder for Internet Explorer)
What is the Index.dat file used for? - ✅AutoComplete & Redundant information such
as visited URLs, search queries, recently opened files
,(* Index.dat is used for redundant information such as AutoComplete information. *
Index.dat can be found in the History folder for Internet Explorer)
Which of the following is true about the swap file? - ✅Hidden file in the root directory called
pagefile.sys & Registry path is
HKEY_LOCAL_MACHINE_SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management
(The swap file can be organized as a contiguous space so fewer I/O operations are required
to read and write. It is a hidden file in the root directory called pagefile.sys.)
Which of the following is true about the swap file? - ✅Hidden file in the root directory called
pagefile.sys & Registry path is
HKEY_LOCAL_MACHINE_SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management
(The swap file can be organized as a contiguous space so fewer I/O operations are required to
read and write. It is a hidden file in the root directory called pagefile.sys.)
Each process of Windows is represented as an _______. - ✅Executive process
(Each process on a Windows system is represented as an executive process or EProcess.
EProcess block is a data structure containing attributes of the process and pointers to threads
and process environment blocks.)
Each process of Windows is represented as an _______. - ✅Executive process
(Each process on a Windows system is represented as an executive process or EProcess.
EProcess block is a data structure containing attributes of the process and pointers to threads
and process environment blocks.)
What command is used to view EProcess block? - ✅dt -a -b -v _EPROCESS
What command is used to view EProcess block? - ✅dt -a -b -v _EPROCESS
,What is the most important element of EProcess? - ✅PEB - Process Environment Block
What is the most important element of EProcess? - ✅PEB - Process Environment Block
What are the six stages of process creation? - ✅1. Launch .exe: File Execution Options
registry key is checked for debugger value. If yes, process starts over
EProcess object created along with KProcess, PEB, and initial address space
Initial thread created
Windows subsystem is notified of new process and thread
Execution of initial thread starts
Initialization of address space is complete for new process and thread
What are the six stages of process creation? - ✅1. Launch .exe: File Execution Options
registry key is checked for debugger value. If yes, process starts over
EProcess object created along with KProcess, PEB, and initial address space
Initial thread created
Windows subsystem is notified of new process and thread
Execution of initial thread starts
Initialization of address space is complete for new process and thread
True or False: The EProcess object is created along with KProcess, PEB, and initial address
space - ✅True
True or False: The EProcess object is created along with KProcess, PEB, and initial address
space - ✅True
What tool can parse memory? - ✅Lsproc.pl d:\dumps\test-mem.dmp
, What tool can parse memory? - ✅Lsproc.pl d:\dumps\test-mem.dmp
What is an important consideration for complete memory dump analysis? - ✅Pagefile.sys
(The swap file, called pagefile.sys, is virtual memory. Information in the swapfile must also be
considered when analyzing memory.)
What is an important consideration for complete memory dump analysis? - ✅Pagefile.sys
(The swap file, called pagefile.sys, is virtual memory. Information in the swapfile must also be
considered when analyzing memory.)
What files contain pool headers? - ✅Pooltag.txt
(Windows memory manager generally allocates memory in 4KB pages. Sometimes, 4K would be
too large and waste memory. So memory manager allocates several pages ahead of time thus
keeping an available pool of memory.)
What files contain pool headers? - ✅Pooltag.txt
(Windows memory manager generally allocates memory in 4KB pages. Sometimes, 4K would be
too large and waste memory. So memory manager allocates several pages ahead of time thus
keeping an available pool of memory.)
What is the advantage of PMDump? - ✅Dump contents of process memory without
stopping the process
What is the advantage of PMDump? - ✅Dump contents of process memory without
stopping the process
What does HKEY_CURRENT_USER contain? - ✅Active, loaded user profile for currently
logged-on user
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller KenAli. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $15.49. You're not tied to anything after your purchase.
