You are a forensic investigator working for a cybersecurity firm tasked with analyzing a suspicious Microsoft Office document named "infected_doc." The document was discovered in an email attachment sent to multiple employees at a large corporation. Concerns have been raised about potential malware embedded within the document, particularly involving VBA macros. As a forensic investigator examining the "infected_doc" Microsoft Office document, what initial step would you take to identify suspicious or malicious components within the file?
Correct Answer: A
This question aligns with CHFI v11 objectives under Malware Forensics and Static Malware Analysis of Suspicious Documents . When analyzing potentially malicious Microsoft Office documents, CHFI v11 emphasizes that investigators should always begin with static analysis before attempting any form of execution. This approach minimizes risk and helps identify embedded threats such as VBA macros, OLE objects, exploits, and obfuscation techniques without activating the payload. The oleid tool (part of the oletools suite) is specifically designed for the initial inspection of OLE-based Microsoft Office documents . It quickly identifies indicators of compromise such as the presence of macros, embedded objects, suspicious file formats, encryption, and known exploit characteristics. CHFI v11 highlights oleid as a safe, non-intrusive first step to triage Office documents and determine whether deeper analysis (e.g., macro extraction or sandbox execution) is warranted. Opening the document in a sandbox is a dynamic analysis step and should only occur after static indicators confirm malicious intent. The other options are either non-standard or insufficient for detecting embedded macro-based malware. Therefore, consistent with CHFI v11 malware forensics methodology, executing oleid to review suspicious components is the correct initial step.
312-49v11 Exam Question 42
During a forensic investigation of a compromised system, the investigator is analyzing various forensic artifacts to determine the nature and scope of the attack. The investigator is specifically looking for information related to failed sign-in attempts, security policy changes, alerts from intrusion detection systems, and unusual application malfunctions. Which type of forensic artifact is most likely to contain this critical information?
Correct Answer: D
This question aligns directly with CHFI v11 objectives under Computer Forensics Fundamentals and Log Analysis . Log files are among the most critical forensic artifacts because they provide a chronological and authoritative record of system, security, and application events . CHFI v11 emphasizes that logs are essential for reconstructing attack timelines, identifying unauthorized access attempts, and determining the scope of a compromise. Artifacts such as failed sign-in attempts , security policy modifications , IDS alerts , and application errors are routinely recorded in log sources including Windows Security logs, system logs, application logs, firewall logs, and IDS/IPS logs. These logs allow investigators to correlate events across systems, identify brute-force attacks, detect privilege escalation, and recognize abnormal behavior caused by malware or misconfiguration. Cryptographic artifacts focus on key usage and encryption operations, browser artifacts relate to user web activity, and process or memory artifacts provide insight into live execution states-but none provide the comprehensive, event-based historical visibility required to answer all aspects of the question. CHFI v11 highlights log analysis as the primary method for understanding what happened, when it happened, how it happened, and who was involved . Therefore, log file anomalies are the most relevant and reliable forensic artifacts in this scenario.
312-49v11 Exam Question 43
A system administrator is configuring a new storage array for a critical application and selects a RAID level that uses data stripping and dedicated parity. The RAID setup requires a minimum of three disks, and it ensures data is striped at the byte level across multiple drives, with one drive set aside to store the parity information for fault tolerance. After configuring the RAID system, the administrator tests its ability to tolerate a single drive failure and confirms the system can still function without data loss. Which RAID level is the system administrator using in this scenario?
Correct Answer: B
Option B. RAID 3 is the correct answer because the question describes a RAID level that uses byte-level striping with a dedicated parity disk and requires at least three disks . That combination matches RAID 3. CHFI v11 explicitly includes RAID Storage System , RAID and Virtualization , and the broader understanding of storage structures under digital evidence fundamentals, so candidates are expected to recognize RAID types and how they affect evidence acquisition and recovery. The key clues are the dedicated parity drive and the fact that the system can continue functioning after a single disk failure . RAID 3 is designed to provide fault tolerance for one failed drive by reconstructing data from the remaining striped disks and the parity information. This makes it different from RAID 0 , which has no redundancy, RAID 1 , which mirrors data rather than using dedicated parity, and RAID 10 , which combines striping and mirroring in a different way. Because the scenario precisely describes byte-level striping plus one parity disk with single-disk fault tolerance, RAID 3 is the only answer that fully fits the described configuration.
312-49v11 Exam Question 44
Sophia, a forensic expert, is analyzing a system for signs of malware. She observes that the malware has been modifying Windows services and running processes to ensure its operation in the background without detection. She needs to determine which services are automatically starting when the system boots. Which tool should Sophia use to examine the Windows services that are set to start automatically?
Correct Answer: C
Option C. Autoruns is the best answer because the question is specifically about identifying services and other components configured to start automatically during boot . In CHFI-style Windows forensics and malware persistence analysis, investigators focus on auto-start mechanisms , including services, registry run keys, startup folders, drivers, scheduled tasks, and related launch points. Autoruns is designed to enumerate these persistence locations in a comprehensive way, making it the most appropriate tool among the options. Event Viewer is useful for examining logs and system events, but it is not the primary tool for enumerating all boot-start and auto-start entries. Task Manager can show currently running processes and some startup items, but it is less complete than Autoruns for deep persistence analysis. Process Explorer is excellent for analyzing active processes and parent-child relationships, yet it is not focused on full startup enumeration. Because Sophia wants to identify which Windows services are configured to start automatically , the most effective forensic tool is Autoruns , which directly supports malware persistence investigation and startup analysis.
312-49v11 Exam Question 45
An attacker, seeking to anonymize their internet activity, utilizes the Tor network, which routes their traffic through a series of relays to obscure the original source. This method is designed to protect the user ' s identity and location. However, despite these measures, the attacker's traffic is traced and identified at the exit relay, potentially exposing them to legal consequences. In response, the attacker turns to a bridge node to circumvent stringent network censorship in a region where access to the Tor network is blocked, thereby regaining access to Tor and attempting to preserve their anonymity. Which role does the bridge node play in the attacker ' s attempt to bypass censorship?
Correct Answer: B
Option B is correct because CHFI v11 explicitly includes TOR Relays and TOR Bridge Node and how the TOR Browser works within the dark web objectives. A bridge node is used when direct access to public Tor entry nodes is blocked or censored. Its role is to function as a less obvious entry point into the Tor network so that users in restricted environments can still connect. This makes bridge nodes especially important in environments where governments, enterprises, or network administrators attempt to block known Tor infrastructure. The bridge does not primarily perform encryption on behalf of the user, nor does it decrypt traffic for final delivery. Instead, it helps the user get into the Tor network without relying on a publicly listed entry relay that may be blocked. Option A is inaccurate because Tor encryption is part of the broader Tor routing process, not a unique function of the bridge node. Option C misunderstands the bridge's purpose, and D describes a role more closely related to traffic exiting the Tor path. Therefore, the bridge node's role is to help bypass censorship by serving as a less detectable entry point.
