CHFI Database Forensics

Question 1

Which SQL Server system database stores metadata about all other databases on the SQL Server instance?

Accepted Answer

master

Answer

The master database stores all instance-level metadata including login accounts, endpoints, linked servers, and configuration settings.

Question 2

In database forensics, which log file type records every transaction and database modification for SQL Server?

Accepted Answer

Transaction log (.ldf)

Answer

The SQL Server transaction log (.ldf) records all transactions and database modifications, making it critical for forensic timeline reconstruction.

Question 3

What tool can a CHFI investigator use to read and analyze MySQL binary logs during a database forensic investigation?

Accepted Answer

mysqlbinlog

Answer

The mysqlbinlog utility reads MySQL binary log files, allowing investigators to reconstruct all SQL statements executed on the server.

Question 4

During a database forensics investigation, an investigator finds rows in a SQL Server table with no matching audit records. What should be checked first?

Accepted Answer

The transaction log for direct inserts

Answer

Direct inserts bypassing the application layer appear in the transaction log even if application-level audit triggers did not fire.

Question 5

Which Oracle database view provides information about all currently connected sessions and can help identify unauthorized access?

Accepted Answer

V$SESSION

Answer

V$SESSION is a dynamic performance view in Oracle that displays information about all current database sessions including username, logon time, and program.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Database Forensics