An investigator needs to identify which processes on a macOS system have made network connections. Which command or tool would provide the most comprehensive view?

Use `ifconfig -a` to list network interfaces and IP addresses

Use `ps aux` to list all processes and manually check each one

Use `lsof -i` to list open network files and associated processes

Use `netstat -an` to list all connections without process information

An investigator is analyzing a Linux system that was compromised. The attacker used a rootkit that hides processes from `ps` and `netstat`. Which technique would be most effective in identifying the hidden processes and their network connections?

Run `netstat -tunap` and compare with `ss -tunap`

Use `strace` to trace system calls of the `ps` command

Use `lsof -i` to list network connections and processes

Compare the output of `ps aux` with the contents of /proc

An investigator is reconstructing the activities of a macOS user who is suspected of unauthorized access. The investigator wants to see a chronological record of system and user events. Which tool or command would provide the most comprehensive unified log access?

log show --start "2023-01-01 00:00:00" --end "2023-01-02 00:00:00"

A forensic examiner is investigating a Mac that was used to access sensitive corporate data. The user claims they only used Safari, but the examiner suspects other browsers were used. Which approach would best confirm or refute this?

Check only the Safari history and cookies in ~/Library/Safari

Check the Keychain for saved passwords from other browsers

Check the user's bash history for browser commands

Check the unified log for browser process executions and network connections

A forensic investigator is examining a Linux system that was running an ext4 file system. The investigator needs to recover deleted files, but the system has been used since the deletion, and the investigator must also preserve the integrity of the evidence. Which approach best balances the need for recovery and evidence preservation?

Use the 'dd' command to copy only the deleted files to an external drive.

Run recovery tools directly on the live system to maximize the chance of recovering data before it is overwritten.

Create a bit-for-bit image of the entire disk and perform recovery on the image using forensic tools.

Power off the system immediately and then boot from a forensic live CD to run recovery tools on the raw disk.

EC-CouncilComputer Hacking Forensic Investigator

Domain 3Objective 2

Linux and Mac Forensics CHFI Practice Questions (Page 2)

Part of the Operating System Forensics domain, which makes up ~12% of our current practice bank.

31questions here

7free pages

12concepts

Questions 6–10

6application · medium
An investigator needs to identify which processes on a macOS system have made network connections. Which command or tool would provide the most comprehensive view?
Select an answer first
7expert · hard
An investigator is analyzing a Linux system that was compromised. The attacker used a rootkit that hides processes from `ps` and `netstat`. Which technique would be most effective in identifying the hidden processes and their network connections?
Select an answer first
8application · medium
An investigator is reconstructing the activities of a macOS user who is suspected of unauthorized access. The investigator wants to see a chronological record of system and user events. Which tool or command would provide the most comprehensive unified log access?
Select an answer first
9expert · hard
A forensic examiner is investigating a Mac that was used to access sensitive corporate data. The user claims they only used Safari, but the examiner suspects other browsers were used. Which approach would best confirm or refute this?
Select an answer first
10expert · hard
A forensic investigator is examining a Linux system that was running an ext4 file system. The investigator needs to recover deleted files, but the system has been used since the deletion, and the investigator must also preserve the integrity of the evidence. Which approach best balances the need for recovery and evidence preservation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.