CHFI Application, Email and Cloud Forensics — 40 Questions

Question 1

A security analyst reviews an Apache access log entry: 192.168.1.5 - - [10/Jan/2024:08:12:35 +0000] "GET /index.php?id=1 UNION SELECT username,password FROM users-- HTTP/1.1" 200 4321 "-" "Mozilla/5.0". What type of attack is MOST likely indicated?

Accepted Answer

SQL injection. The log entry shows a UNION SELECT statement appended to the id parameter, which is a classic SQL injection attempt.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Remote file inclusion

Question 2

During an investigation, an analyst extracts email headers from a suspicious email. The header includes: Received: from mail.attacker.com (192.168.1.100); DKIM-Signature: v=1; a=rsa-sha256; d=legitbank.com; s=selector1; bh=...; The email claims to be from support@legitbank.com. Which indicator strongly suggests email spoofing?

Accepted Answer

The Received header shows the email came from a server not owned by legitbank.com. The DKIM-Signature domain (d=legitbank.com) should match the sender domain. However, the Received header shows the email originated from mail.attacker.com, not legitbank.com's mail servers. Additionally, analyzing the DKIM signature might fail if it doesn't match, but the mismatch in origin is a clear spoofing indicator.

Answer

The email was sent on a weekend

Answer

The DKIM signature uses RSA-SHA256 algorithm

Answer

The X-Originating-IP header is present

Question 3

A forensic analyst is examining a Docker container suspected of being used for malicious activities. The container was running an Alpine Linux image and was stopped 2 hours ago. Which of the following is the BEST first step to collect volatile evidence?

Accepted Answer

Export the container's filesystem using docker export. When a container is stopped, its process state and other in-memory data are lost. The best first step is to create a forensic image of the container's filesystem layers, which are still available on the host. Docker containers' filesystems are stored as layers on the host, accessible via docker export or by copying the container's filesystem from /var/lib/docker/overlay2/.

Answer

Collect the container's log files from /var/log/

Answer

Create a memory dump of the container's process

Answer

Run docker attach to reconnect to the container

Question 4

A cloud forensics investigator is analyzing an incident in AWS. The suspect is alleged to have deleted an S3 bucket. Which AWS service log would contain the DeleteBucket API call details, including the source IP and user identity?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made to the AWS environment, including S3 bucket deletions. It logs the identity, source IP, and request parameters.

Answer

VPC Flow Logs

Answer

Amazon S3 access logs

Answer

AWS Config

Question 5

Which tool is specifically designed to analyze email headers and track the path an email took across mail servers?

Accepted Answer

EmailTracker. EmailTracker is a tool that parses email headers and visualizes the route, timing, and geolocation of mail servers.

Answer

Wireshark

Answer

Volatility

Answer

FTK Imager

Question 6

An investigator examining a compromised web server finds a file named shell.aspx in the uploads directory. The file contains code that accepts commands via HTTP POST and executes them on the server. What is the MOST likely type of attack?

Accepted Answer

Webshell. A file that accepts and executes commands remotely is a webshell, often placed via file upload vulnerabilities to maintain access.

Answer

Server-side request forgery (SSRF)

Answer

SQL injection

Answer

Cross-site request forgery (CSRF)

Question 7

A forensic examiner needs to analyze a Microsoft Outlook PST file from a suspect's computer. Which tool is BEST suited to parse and extract emails, attachments, and metadata from the PST file?

Accepted Answer

Aid4Mail. Aid4Mail is a professional email forensic tool that can parse PST files and extract all components including metadata, attachments, and headers.

Answer

DB Browser for SQLite

Answer

MailXaminer

Answer

Outlook Express

Question 8

An organization uses Azure. A security analyst needs to investigate a suspicious login event. Which Azure log contains details about user sign-ins, including IP address, timestamp, and success/failure status?

Accepted Answer

Azure AD Sign-in logs. Azure Activity Logs (now also called Azure Monitor activity log) record subscription-level events, but user sign-in details are specifically in Azure AD Sign-in logs, which are part of Azure Active Directory reporting. However, the question asks about Azure logs; the most appropriate is Azure AD Sign-in logs, but since that's not an option, the closest is Azure Activity Logs which can capture management events, but not sign-ins. Actually, Azure AD Sign-in logs are the correct source. But given options, if only Azure Activity Logs is present, it's partially correct. The typical answer is Azure AD Sign-in logs. Since the question says "Azure log", the best choice is Azure Activity Logs as it's within Azure Monitor, but it's not precise. Let's adjust options accordingly. I'll assume Azure AD Sign-in logs is not listed; I'll create a plausible distractor. Actually, in real exam, they expect Azure AD Sign-in logs. I'll make sure one option says "Azure AD Sign-in logs". But the stem says "Azure log", so I'll include it. Let me redo: The correct answer should be Azure AD Sign-in logs. I'll set that as option A.

Answer

Azure Monitor Metrics

Answer

Azure Activity Logs

Answer

Azure Security Center alerts

Question 9

In database forensics, which type of log records every transaction (including INSERT, UPDATE, DELETE) and allows reconstruction of database changes over time?

Accepted Answer

Transaction log. Transaction logs (also called redo logs) record all changes to the database, enabling point-in-time recovery and auditing of data modifications.

Answer

Audit log

Answer

Error log

Answer

Slow query log

Question 10

An analyst finds the following in an IIS log: 10.0.0.5, -, 02/15/2024, 14:23:56, GET /../../windows/system32/cmd.exe, 404, 0, 0, 0, Mozilla/4.0. Which attack technique does this log entry represent?

Accepted Answer

Path traversal. The URI contains ../ patterns attempting to access a system file outside the web root, which is path traversal.

Answer

Cross-site scripting

Answer

SQL injection

Answer

Remote code execution

Question 11

During a cloud forensic investigation, the analyst discovers that the suspect used AWS IAM credentials to launch unauthorized EC2 instances. The suspect claims the credentials were stolen. Which log would the analyst examine to determine the source IP address from which the credentials were used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all API calls, including the source IP address of the request. By analyzing CloudTrail events for the RunInstances API, the analyst can see the IP address.

Answer

VPC Flow Logs

Answer

Amazon Inspector findings

Answer

AWS Config

Question 12

Which of the following is a significant challenge in cloud forensics compared to traditional digital forensics?

Accepted Answer

Multi-tenancy and data segregation. Multi-tenancy in cloud environments means that evidence from one tenant may be co-mingled with data from other tenants, and isolation can be difficult.

Answer

Inability to collect memory dumps

Answer

Lack of logging

Answer

Data volatility

Question 13

Which TWO pieces of information can be obtained from an email's Received headers to help trace the email's origin? (Select TWO)

Accepted Answer

The IP address of the originating mail server. Received headers show each mail server the email passed through, including its IP address and timestamp.

Answer

The DKIM signature hash

Answer

The sender's email client version

Answer

The subject line of the email

Question 14

Which THREE of the following are common challenges specific to cloud forensics? (Select THREE)

Accepted Answer

Data jurisdiction and legal compliance across regions. Cloud forensics faces challenges such as data jurisdiction (legal boundaries), volatile evidence (ephemeral resources), and multi-tenancy (data commingling).

Answer

Lack of standardized log formats

Answer

High cost of forensic tools

Question 15

Which TWO of the following are indicators of a webshell attack found in web server logs? (Select TWO)

Accepted Answer

Requests to a .asp or .php file with parameters like cmd or exec. Webshells often involve file uploads to directories like uploads, and subsequent requests to that file with parameters indicating command execution (e.g., cmd=).

Answer

Abnormal HTTP methods like OPTIONS or TRACE

Answer

High volume of traffic from a single IP

Answer

Frequent 404 errors for non-existent pages

Question 16

An analyst examining Apache access logs finds the following entry: 192.168.1.10 - - [10/Oct/2023:13:55:36 -0400] "GET /search.php?q=1'%20OR%20'1'='1 HTTP/1.1" 200 5324 "-" "Mozilla/5.0". Which of the following attacks is MOST likely occurring?

Accepted Answer

SQL injection. The log shows a URI parameter containing SQL injection syntax (1' OR '1'='1). The single quote and OR condition are classic indicators of SQL injection attempts.

Answer

Cross-site scripting (XSS)

Answer

Remote file inclusion

Answer

Path traversal

Question 17

During a forensic investigation of a suspected data breach, you are asked to analyze email headers to trace the origin of a phishing email. Which header field provides the IP address of the sending SMTP server?

Accepted Answer

Received. The Received header is added by each SMTP server that relays the message, showing the IP of the previous hop. The last entry often contains the original sender's IP.

Answer

Message-ID

Answer

DKIM-Signature

Answer

X-Originating-IP

Question 18

A security analyst is investigating a containerized application running on a Docker host. The analyst needs to collect forensic evidence from a stopped container without starting it. Which of the following Docker commands should be used to export the container's filesystem as a tar archive?

Accepted Answer

docker export. docker export exports the container's filesystem as a tar archive. It works on stopped or running containers and does not require the container to be started.

Answer

docker commit

Answer

docker cp

Answer

docker save

Question 19

While investigating a compromised web server, you discover a file named 'shell.php' in the web root. The file contains the following code: <?php system($_GET['cmd']); ?>. Which of the following best describes this file?

Accepted Answer

A web shell. This PHP code executes system commands passed via the 'cmd' GET parameter. This is a classic webshell, allowing remote command execution.

Answer

A SQL injection script

Answer

A file upload vulnerability exploit

Answer

A backdoor trojan

Question 20

An incident responder is analyzing AWS CloudTrail logs to determine if an unauthorized user accessed an S3 bucket. Which of the following CloudTrail event fields should be examined to identify the IAM user or role that made the API call?

Accepted Answer

userIdentity. The userIdentity field contains details about the identity that made the request, including ARN, user name, and type (IAM user, role, etc.).

Answer

sourceIPAddress

Answer

eventSource

Answer

requestParameters