CHFI Practice Test 3 — 10 Questions

Question 1

Which TWO of the following are indicators of a webshell on a web server? (Select TWO.)

Accepted Answer

The file contains system commands executed via GET or POST parameters. Webshells often have recent modification times out of sync with other files, and they typically accept command parameters in GET/POST requests. Large file size alone is not definitive, and missing index.html is unrelated.

Answer

A file named 'cmd.php' with a modification date matching other legitimate files

Answer

The server's index.html file is missing

Answer

The file is over 1 MB in size

Question 2

Which email header field is used to verify that an email was sent by the authorized mail server for the domain and has not been tampered with, using cryptographic signatures?

Accepted Answer

DKIM-Signature. DKIM (DomainKeys Identified Mail) uses a digital signature to verify the email's origin and integrity.

Answer

X-Mailer

Answer

Message-ID

Answer

Received-SPF

Question 3

During a network forensic investigation, the analyst recovers a PCAP file. What type of information can be directly extracted from this file?

Accepted Answer

Files transferred via HTTP. A PCAP file captures raw network packets. HTTP is an application-layer protocol that transmits data (e.g., files, web pages) in cleartext over TCP. By reassembling TCP streams from the captured packets, an analyst can directly extract files transferred via HTTP, as the payload contains the actual file content.

Answer

Operating system version of the source host

Answer

Registry data of the destination host

Answer

Disk partition table of the sending computer

Question 4

Locard's exchange principle is fundamental to forensic science. How does this principle apply to computer forensics?

Accepted Answer

Every action on a digital device leaves some trace of evidence.. Locard's principle states that every contact leaves a trace; in digital forensics, this translates to digital traces left behind when a system is accessed.

Answer

Digital evidence is always volatile and must be preserved immediately.

Answer

Evidence must be collected within 24 hours.

Answer

Only physical evidence, such as fingerprints, can be left at a crime scene.

Question 5

An IIS log entry shows: `2024-07-15 14:22:10 10.0.0.5 GET /../../windows/system32/cmd.exe 404 - Mozilla/5.0`. What attack technique does this log entry indicate?

Accepted Answer

Directory traversal. The presence of '../' sequences in the URI path indicates a path traversal attack attempting to access files outside the web root.

Answer

Remote code execution (RCE)

Answer

Cross-site request forgery (CSRF)

Answer

SQL injection

Question 6

A security analyst finds the following entry in the Apache access log: 10.0.0.5 - - [20/Jan/2023:08:12:44 +0000] "GET /../../../../etc/passwd HTTP/1.1" 404 345 "-" "curl/7.68.0". Which attack was attempted?

Accepted Answer

Path Traversal. The URI contains '../../../../etc/passwd', which is a path traversal attempt to read the /etc/passwd file. The 404 status indicates the file was not found, but the intent is clear.

Answer

Remote File Inclusion

Answer

Command Injection

Answer

Cross-Site Request Forgery (CSRF)

Question 7

A forensic analyst is investigating a MySQL database server breach. Which log is MOST useful for identifying a series of queries that exfiltrated data, assuming the attacker used a compromised application account?

Accepted Answer

General query log. MySQL general query log logs all queries, but can be resource-intensive. Binary logs record changes. Error logs contain errors. Slow query log logs slow queries. The general query log is best for seeing all queries from a compromised account.

Answer

Binary log

Answer

Slow query log

Answer

Error log

Question 8

A network analyst captures a packet with Wireshark showing a TCP SYN packet from IP 10.0.0.5 to 192.168.1.10 port 443, followed immediately by a SYN‑ACK from 192.168.1.10 to 10.0.0.5, then an RST from 10.0.0.5. What does this sequence MOST likely indicate?

Accepted Answer

A TCP SYN scan (stealth scan). A SYN followed by SYN‑ACK and then RST is typical of a port scan where the scanner sends a SYN, receives a SYN‑ACK (port open), and then immediately resets the connection to avoid completing the handshake.

Answer

A man‑in‑the‑middle attack

Answer

A denial‑of‑service (SYN flood) attack

Answer

A normal HTTPS session initiation

Question 9

A forensic investigator finds a suspicious file named `cmd.aspx` in the web root of a compromised IIS server. The file contains code that accepts command input via HTTP GET parameters and executes it on the server. What is the MOST likely classification of this file?

Accepted Answer

Web shell. A file that accepts commands via HTTP and executes them on the server is a web shell. ASPX is a common extension for .NET web shells.

Answer

Trojan horse

Answer

Cross-site scripting (XSS) exploit

Answer

SQL injection payload

Question 10

A security analyst is reviewing Apache access logs and finds repeated requests to /index.php?id=1' OR '1'='1. Which type of attack is MOST likely being attempted?

Accepted Answer

SQL injection. The pattern 1' OR '1'='1 is a classic SQL injection payload attempting to bypass authentication or extract data. The single quote and OR condition are characteristic of SQLi.

Answer

Remote file inclusion

Answer

Path traversal

Answer

Cross-site scripting (XSS)