Free CAWFE Practice Questions

Question 1

An authorized examiner reaches a running Windows laptop minutes before it is to be disconnected for transport. Its BitLocker-protected system volume is unlocked, but no recovery material has been obtained. The laptop has stable external power, is already isolated from the network, and shows no ongoing destructive activity. A compatible RAM acquisition tool and separate evidence storage are ready. Which acquisition sequence best protects evidence that may become inaccessible after power loss?

Accepted Answer

Maintain power, capture RAM, and acquire accessible plaintext to the separate evidence storage.

Answer

Shut down to prevent further background changes, then acquire the drive through a hardware write blocker.

Answer

Acquire the raw disk first, then collect RAM before transport.

Answer

Hibernate the laptop for transport, then use its saved hibernation state instead of acquiring live memory.

Question 2

The exported forecast.xlsx has the same SHA-256 hash as the source file's unnamed $DATA stream. Separate stream enumeration of the source also finds forecast.xlsx:review:$DATA containing 8,192 bytes. The export contains no named streams. What does the successful hash comparison actually verify?

Accepted Answer

The unnamed stream matches, but the 8,192-byte named stream was not preserved.

Answer

All file content matches; named streams contain only NTFS metadata.

Answer

The named stream was included in the exported spreadsheet content, although its separate stream name was lost.

Answer

The spreadsheet content changed during export; omitting a named stream necessarily changes the unnamed stream's hash.

Question 3

An offline SYSTEM hive contains Select\Current = 2 and Select\LastKnownGood = 1. For the service ArchiveAgent, ControlSet001 records Start = 4 and Type = 0x20; ControlSet002 records Start = 2 and Type = 0x10. The hive and its associated logs have been recovered consistently. How was ArchiveAgent configured in the control set current at acquisition?

Accepted Answer

Automatic start, configured for a separate service process.

Answer

Disabled, configured to share a process with other services.

Answer

Demand start, configured for a separate service process.

Answer

Automatic start, configured to share a process with other services.

Question 4

A version-30 Windows Prefetch file for an archiving utility parses without structural errors. Its run-count field contains 23, and its last-run array contains eight nonzero timestamps. The examiner is building an execution timeline. How should the count and timestamps be reconciled?

Accepted Answer

Use the eight recorded run times; this format does not retain a separate timestamp for every counted run.

Answer

Use eight as the execution count; the value 23 includes dependent files loaded during those launches.

Answer

Distribute all 23 launches among the eight timestamps; multiple executions are combined into each recorded time.

Answer

Use the oldest retained timestamp as the first launch; the count places all 23 executions within that interval.

Question 5

An acquired GPT disk has a primary header that fails its CRC32 check. The backup header at the final LBA and its referenced partition-entry array pass their CRC32 checks. The backup entries are within disk bounds, and file-system structures are consistent with their starting LBAs. Which partition map should be used for the initial read-only examination?

Accepted Answer

The validated backup GPT, with the inconsistent primary metadata preserved and documented.

Answer

None; suspend volume examination until another acquisition passes primary-header validation.

Answer

The primary GPT entries, because their location at the start of the disk takes precedence over the backup.

Answer

The protective MBR, treating its 0xEE entry as the Windows data partition when the primary GPT fails validation.

Question 6

Unlocking BitLocker on a forensic working copy makes ordinary documents readable, but several NTFS files still cannot be decrypted. Their metadata identifies EFS encryption, and the examination account already has sufficient file-access permissions. What additional material addresses the remaining encryption layer?

Accepted Answer

The appropriate EFS user or recovery-agent private key.

Answer

The volume's BitLocker recovery password.

Answer

The original owner's SID together with the files' NTFS security descriptors.

Answer

The EFS public certificate exported without its corresponding private key.

Question 7

An uncompressed NTFS file has a nonresident $DATA attribute beginning at virtual cluster number (VCN) 0. The cluster size is 4,096 bytes, and its complete runlist is 11 03 30 11 02 FC 01 01 00 (hexadecimal bytes). The examiner needs the first byte of VCN 4. All stated byte offsets are relative to the start of the NTFS volume. Which source supplies that byte?

Accepted Answer

LCN 45, at volume byte offset 184,320.

Answer

LCN 52, at volume byte offset 212,992.

Answer

LCN 301, at volume byte offset 1,232,896.

Answer

A logical zero; VCN 4 falls within the sparse run and has no disk allocation.

Question 8

A legacy 32-bit desktop application runs without elevation and has no requestedExecutionLevel in its manifest. The user can read the machine key HKLM\Software\LegacyTool but has no permission to write there. The application nevertheless reports a successful write of Mode = 1 and reads that value on subsequent launches. The machine store still contains Mode = 0, while the user's class hive contains VirtualStore\MACHINE\SOFTWARE\LegacyTool\Mode = 1. What accounts for the application's view?

Accepted Answer

Registry virtualization redirected the write to a per-user store that overrides the global value.

Answer

WOW64 Registry redirection has placed the machine-wide setting in the alternative architecture view.

Answer

A pending hive transaction has changed the global value in memory but has not yet reached the machine store.

Answer

File-system virtualization has stored the setting in a redirected configuration file instead of a Registry hive.

Question 9

The following Security log records come from one workstation and one boot session (provider Microsoft-Windows-Security-Auditing):
14:01 - event 4624; account Morgan; LogonType 3; TargetLogonId 0x51A.
14:06 - event 4624; account Morgan; LogonType 10; TargetLogonId 0x6B2.
14:07 - event 4688; NewProcessName C:\Tools\7z.exe; Creator Subject Logon ID 0x6B2.
What do the matching identifiers establish about the process creator?

Accepted Answer

The creator operated in Morgan's remote-interactive logon context, identified by 0x6B2.

Answer

The creator used Morgan's earlier network logon context, 0x51A.

Answer

The creator operated in a local-interactive context, because the executable path is on the workstation.

Answer

The creator operated in a service logon context, because an archiving utility can run without a visible window.

Question 10

At 10:40, an examiner captures RAM from a Windows workstation. Pool scanning recovers transfer.exe with PID 2460, creation time 10:00, exit time 10:12, and process-object address 0xFFFFAB0100200000. The active-process list instead contains browser.exe with PID 2460, created at 10:30 at address 0xFFFFAB0100900000. A recovered TCP endpoint has creation time 10:05, state ESTABLISHED, and an owner pointer to 0xFFFFAB0100200000. Which reconstruction fits these objects?

Accepted Answer

The endpoint belongs to the earlier transfer.exe incarnation, not to the later browser.exe process.

Answer

The endpoint belongs to browser.exe, the active process with PID 2460.

Answer

Transfer.exe remains active but hidden from the process list because its recovered endpoint still says ESTABLISHED.

Answer

The endpoint cannot be associated with either executable because reuse of PID 2460 invalidates its ownership information.

Free CAWFE Practice Questions

Domain 1: Windows Virtualization Technologies and inbuilt security mechanisms

Question 1

Domain 2: Windows Partitioning Schemes

Question 2

Domain 3: Windows File Systems

Question 3

Question 4

Domain 4: Windows Registry

Question 5

Question 6

Domain 5: Windows Artifacts

Question 7

Question 8

Domain 6: Live Memory Acquisition and Analysis

Question 9

Question 10

That's 10 of 1,030