CHFI General MCQ 3

Question 1

Which of the following best describes steganography in the context of digital forensics?

Accepted Answer

Hiding data within another file or medium

Answer

Steganography is the practice of concealing secret data within ordinary, non-secret files such as images or audio files.

Question 2

A forensic examiner is analyzing a suspect's browser history. Which SQLite database file stores Chrome's browsing history?

Accepted Answer

History

Answer

Chrome stores browsing history in an SQLite file named 'History' located in the user's Chrome profile directory.

Question 3

What is the standard hashing algorithm recommended by NIST for generating forensic hash values to verify evidence integrity?

Accepted Answer

SHA-256

Answer

NIST recommends SHA-256 for generating forensic hash values as it provides stronger collision resistance than MD5 or SHA-1.

Question 4

During a CHFI investigation, an examiner needs to analyze Windows event logs for failed logon attempts. Which Event ID should they filter for?

Accepted Answer

4625

Answer

Event ID 4625 is logged in the Windows Security event log for every failed account logon attempt.

Question 5

Which type of forensic acquisition captures only the allocated (active) files and directories rather than the entire disk image?

Accepted Answer

Logical acquisition

Answer

Logical acquisition copies only the active file system contents, missing deleted files and unallocated space.

CHFI - Computer Hacking Forensic Investigator Practice Test