According to the CHFI v11 Operating System Forensics module, the Windows pagefile.sys is a critical forensic artifact because it serves as virtual memory and may contain remnants of sensitive data such as credentials, command history, decrypted content, fragments of documents, and even portions of malicious code that were previously resident in RAM. As a result, understanding where pagefile-related configuration data is stored in the Windows Registry is essential for forensic investigators.
The registry path
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management is the correct location where Windows stores configuration values related to virtual memory management , including the PagingFiles value. This value specifies the location, size, and behavior of the pagefile.sys on the system. CHFI v11 explicitly references this registry key when discussing memory artifacts, virtual memory analysis, and Windows memory forensics .
The other options are not relevant to pagefile analysis. The CurrentVersion key stores OS version details, ControlSet001\Control\Windows contains general system control settings, and ActiveComputerName only identifies the system hostname. None of these paths contain pagefile configuration data.
Therefore, to extract and validate artifacts related to pagefile.sys , Investigator Sarah must examine HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management , making Option D the correct and CHFI v11-verified answer.

According to theCHFI v11 Operating System Forensicsobjectives, the Windows Registry is a critical source of evidence for reconstructinguser activity, particularly in insider threat investigations. One of the most important Registry artifacts for identifyingrecently accessed foldersis theBagMRU key.
TheBagMRUkey is part of the Windows ShellBags artifact structure and is specifically designed to track folder navigation history. It stores hierarchical information about folders accessed by a user, includingfolder names, directory paths, and access order relationships. These keys allow forensic investigators to determine which directories a user browsed, even if the folders were accessed via Windows Explorer and later deleted from the system.
While theMRUListExvalue exists within ShellBag-related keys, it only defines theorder of accessand does not store the actual folder path or name. TheBagskey, on the other hand, storesfolder view settingssuch as icon size, window position, and display preferences-not access history. TheNodeSlotvalue is associated with Jump Lists and application usage tracking rather than directory navigation.
CHFI v11 explicitly highlightsShellBags and BagMRU keysas essential artifacts for reconstructing user behavior, especially in cases involving data exfiltration or insider misuse. Therefore, the correct and CHFI- verified answer isBagMRU key (Option A).

This scenario aligns with CHFI v11 objectives under Standards and Best Practices Related to Computer Forensics , specifically the ENFSI Best Practices for the Forensic Examination of Digital Technology .
According to ENFSI guidelines, once evidence has been seized and secured, a structured laboratory assessment must be conducted before and during analysis. This phase focuses on evaluating exhibits, determining examination priorities, and maintaining detailed documentation of all items-whether analyzed immediately or deferred.
Maintaining records of both analyzed and non-analyzed exhibits is a key ENFSI requirement, as it ensures transparency, traceability, and accountability throughout the forensic process. CHFI v11 emphasizes that proper documentation allows investigators to track investigative progress, justify examination decisions, and demonstrate that no evidence was overlooked or mishandled. This practice also supports effective case management and preserves the integrity and admissibility of evidence in legal proceedings.
The other options describe different forensic phases: case evaluation occurs earlier at a strategic level, scene assessment applies to on-site evidence handling, and data acquisition refers specifically to extraction activities. In contrast, documenting and prioritizing exhibits in a controlled environment is a core function of the laboratory assessment , making option C the correct ENFSI-aligned answer.

According to theCHFI v11 Network Forensics and Log Analysis objectives, monitoring authentication failures is a critical technique for detectingbrute-force and password cracking attacksagainst network services such as FTP. FTP servers communicate authentication outcomes using standardizedFTP response codes, which can be filtered and analyzed using tools likeWireshark.
The FTP response code530explicitly indicates"Not logged in", which commonly occurs when a user provides invalid credentials(incorrect username or password). During brute-force or password spraying attacks, repeated failed login attempts generate multiple530 response codes, making this filter highly effective for identifying malicious authentication activity.
In contrast,ftp.response.code == 230indicates asuccessful login, which is not relevant when tracking failed attempts. The532response code means that an account is required for login, not necessarily a password failure.
The521response code indicates that the FTP service is unavailable, which reflects server-side issues rather than authentication failures.
CHFI v11 specifically emphasizes correlatingnetwork traffic patterns and protocol response codesto identify unauthorized access attempts and credential-based attacks. Filtering forftp.response.code == 530 allows investigators to isolate failed authentication attempts accurately and build evidence of potential password cracking activity.
Therefore, the correct and CHFI-verified answer isftp.response.code == 530 (Option C).

According to the CHFI v11 Web Application Forensics and WAF module , the primary function of a Web Application Firewall (WAF) is to inspect, monitor, and filter HTTP/HTTPS traffic between a web application and its users. Unlike traditional network firewalls, which operate at the network or transport layer, WAFs function at the application layer (Layer 7) and are specifically designed to protect web applications from attacks such as SQL injection, Cross-Site Scripting (XSS), command injection, file inclusion, parameter tampering, and cookie poisoning .
WAFs such as ModSecurity analyze web requests and responses using rule-based logic, signatures, anomaly detection, and behavioral analysis . CHFI v11 emphasizes that WAF logs are critical forensic artifacts, as they record blocked requests, rule violations, payload details, source IP addresses, timestamps, and attack patterns. These logs allow investigators to detect, reconstruct, and attribute web-based attacks during forensic investigations.
The other options do not describe the primary function of a WAF. Encryption of web traffic is handled by SSL/TLS, not WAFs. DDoS protection is typically managed by network-level or cloud-based mitigation systems, although some WAFs may offer limited support. System log monitoring is the role of SIEM solutions, not WAFs.
Therefore, as defined in CHFI v11, the core purpose of a Web Application Firewall is inspecting and filtering HTTP traffic to protect web applications , making Option A the correct and verified answer.