CHFI Database Forensics

Question 1

Which SQL Server system database stores metadata about all other databases on the SQL Server instance?

Accepted Answer

master

Answer

tempdb

Answer

model

Answer

msdb

Question 2

In database forensics, which log file type records every transaction and database modification for SQL Server?

Accepted Answer

Transaction log (.ldf)

Answer

Error log

Answer

Audit log

Answer

Event log

Question 3

What tool can a CHFI investigator use to read and analyze MySQL binary logs during a database forensic investigation?

Accepted Answer

mysqlbinlog

Answer

mysqlcheck

Answer

mysqldump

Answer

mysql_upgrade

Question 4

During a database forensics investigation, an investigator finds rows in a SQL Server table with no matching audit records. What should be checked first?

Accepted Answer

The transaction log for direct inserts

Answer

Firewall logs

Answer

DNS logs

Answer

Application event logs

Question 5

Which Oracle database view provides information about all currently connected sessions and can help identify unauthorized access?

Accepted Answer

V$SESSION

Answer

V$DATAFILE

Answer

DBA_TABLES

Answer

ALL_OBJECTS

Question 6

What is the primary forensic value of the SQL Server msdb database?

Accepted Answer

Contains SQL Agent job history and backup/restore history

Answer

Stores user data tables

Answer

Holds temporary objects

Answer

Stores model database templates