CHFI Application, Email and Cloud Forensics — 50 Questions

Question 1

During an investigation, an analyst extracts email headers from a suspicious email. The header includes: Received: from mail.attacker.com (192.168.1.100); DKIM-Signature: v=1; a=rsa-sha256; d=legitbank.com; s=selector1; bh=...; The email claims to be from support@legitbank.com. Which indicator strongly suggests email spoofing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Received header shows the email came from a server not owned by legitbank.com. The DKIM-Signature domain (d=legitbank.com) should match the sender domain. However, the Received header shows the email originated from mail.attacker.com, not legitbank.com's mail servers. Additionally, analyzing the DKIM signature might fail if it doesn't match, but the mismatch in origin is a clear spoofing indicator.

Answer

The email was sent on a weekend

Answer

The DKIM signature uses RSA-SHA256 algorithm

Answer

The X-Originating-IP header is present

Question 2

A forensic analyst is examining a Docker container suspected of being used for malicious activities. The container was running an Alpine Linux image and was stopped 2 hours ago. Which of the following is the BEST first step to collect volatile evidence?

Accepted Answer

Export the container's filesystem using docker export. The container has been stopped for 2 hours, meaning its process is no longer running and volatile memory (RAM) has been lost. The best first step to collect evidence from a stopped container is to export its filesystem using `docker export`, which captures the container's current state as a tar archive, preserving file system artifacts for analysis.

Answer

Collect the container's log files from /var/log/

Answer

Create a memory dump of the container's process

Answer

Run docker attach to reconnect to the container

Question 3

Which tool is specifically designed to analyze email headers and track the path an email took across mail servers?

Accepted Answer

EmailTracker. EmailTracker is specifically designed to parse and analyze email headers, extracting details such as the originating IP address, mail server hops, and timestamps to reconstruct the delivery path. Unlike general-purpose tools, it focuses on SMTP trace fields (e.g., Received headers) and can correlate them with geolocation and reputation databases to identify routing anomalies or spoofing attempts.

Answer

Wireshark

Answer

Volatility

Answer

FTK Imager

Question 4

A forensic examiner needs to analyze a Microsoft Outlook PST file from a suspect's computer. Which tool is BEST suited to parse and extract emails, attachments, and metadata from the PST file?

Accepted Answer

Aid4Mail. Aid4Mail is the best tool for parsing and extracting emails, attachments, and metadata from Microsoft Outlook PST files because it is a dedicated forensic email analysis tool that supports PST format natively, preserving original metadata (e.g., headers, timestamps, attachments) without altering the source data. It provides comprehensive extraction capabilities, including deleted items and embedded objects, making it ideal for forensic investigations where data integrity and chain of custody are critical.

Answer

DB Browser for SQLite

Answer

MailXaminer

Answer

Outlook Express

Question 5

Which of the following is a significant challenge in cloud forensics compared to traditional digital forensics?

Accepted Answer

Multi-tenancy and data segregation. Multi-tenancy in cloud environments means that evidence from one tenant may be co-mingled with data from other tenants, and isolation can be difficult.

Answer

Inability to collect memory dumps

Answer

Lack of logging

Answer

Data volatility

Question 6

During a forensic investigation of a suspected data breach, you are asked to analyze email headers to trace the origin of a phishing email. Which header field provides the IP address of the sending SMTP server?

Accepted Answer

Received. The 'Received' header field is added by each SMTP server that handles the email, and it typically includes the IP address of the sending server (the client that connected to deliver the message). By examining the bottommost 'Received' header (the first hop), investigators can trace the originating SMTP server's IP address, which is critical for identifying the source of a phishing email.

Answer

Message-ID

Answer

DKIM-Signature

Answer

X-Originating-IP

Question 7

An analyst finds the following entry in an IIS access log: 10.0.0.5, -, 10/10/2023, 14:30:22, W3SVC1, WEB01, 192.168.1.100, 80, GET, /login.aspx, 200, 0, 1234, 567, Mozilla/5.0+. Based on the log format, which field contains the HTTP status code?

Accepted Answer

200. IIS W3C Extended Log Format includes fields: date, time, client IP, cs-uri-stem, sc-status. In the given entry, the status code 200 appears after the URI and before the 0 (sc-substatus).

Answer

GET

Answer

80

Answer

0

Question 8

Which THREE of the following are challenges specific to cloud forensics compared to traditional digital forensics? (Select 3)

Accepted Answer

Data jurisdiction and legal compliance across regions. Option B is correct because cloud data is stored in data centers that may span multiple countries, so forensic investigators must navigate differing legal frameworks, data-protection laws (e.g., GDPR), and cross-border jurisdiction issues that do not arise when evidence resides on a single local disk. Option C is correct because cloud environments use multi-tenancy, where multiple customers' data and workloads share the same physical hardware and storage, creating co-mingling and isolation challenges that complicate evidence identification and seizure compared to a single-tenant physical machine. Option D is correct because cloud workloads are often ephemeral and rely on volatile resources such as RAM, container instances, and auto-scaled VMs without persistent local storage, so evidence can be lost on shutdown or migration, unlike traditional forensics where a disk image can be captured after the fact. Option A is not specific to cloud forensics, since chain of custody documentation is a foundational requirement in all digital forensics, not a cloud-unique challenge. Option E is not specific either, because physical access to the hard drive is generally unavailable in cloud environments, but that is a limitation of the cloud model rather than a distinct forensic challenge in the same category as the marked options.

Answer

Chain of custody documentation

Answer

Physical access to the hard drive

Question 9

In a database forensic investigation, you recover a MySQL binary log with the following entry: #230110 13:45:22 server id 1 end_log_pos 123456 Query thread_id=100 exec_time=0 error_code=0 SET TIMESTAMP=1673358322; SELECT * FROM customers INTO OUTFILE '/tmp/export.csv';. What does this indicate?

Accepted Answer

Data exfiltration via the MySQL instance. The command SELECT * FROM customers INTO OUTFILE '/tmp/export.csv' exports query results to a file on the server, which can indicate data exfiltration. However, this command would not appear in a MySQL binary log. It might be found in a general query log or audit log. The correct interpretation, assuming the entry exists, is still data exfiltration, but the log type in the stem is incorrect.

Answer

A backup operation was performed

Answer

A stored procedure execution

Answer

A SQL injection attack using UNION

Question 10

An email header shows the following Received line: Received: from mail.example.com (192.168.1.1) by smtp.server.com (Postfix). The DKIM-Signature header is missing, and the X-Originating-IP header shows an IP address different from the sender's domain MX record. What is the MOST likely conclusion?

Accepted Answer

The email is likely spoofed. DKIM is not always present in legitimate email. X-Originating-IP represents the sender's client IP, while the MX record is the domain's inbound mail server; they are not expected to match. A mismatch therefore does not suggest spoofing. The private IP in the Received header may indicate an internal relay, but no definitive conclusion can be drawn. None of the given options is clearly the 'most likely' conclusion.

Answer

The email is legitimate but routed through a different server

Answer

The email was sent from a mobile device

Answer

The email server is misconfigured

Question 11

During a cloud forensic investigation, you review AWS CloudTrail logs and find the following event: {"eventSource":"ec2.amazonaws.com","eventName":"RunInstances","userIdentity":{"arn":"arn:aws:iam::123456789012:user/attacker"},"requestParameters":{"instanceType":"t2.micro","imageId":"ami-0abcdef1234567890"},"responseElements":{"instancesSet":{"items":[{"instanceId":"i-0a1b2c3d4e5f67890"}]}}}. What is the immediate forensic action?

Accepted Answer

Isolate the instance and create a forensic snapshot. The log shows an unauthorized user launched an EC2 instance. The immediate action is to isolate the instance by stopping it or applying a security group to block traffic, preventing further malicious activity while preserving the instance for forensic analysis.

Answer

Delete the instance immediately

Answer

Check the VPC flow logs for network traffic

Answer

Notify the user who launched the instance

Question 12

In Docker forensics, which command is used to view the command history of a container, including how it was built?

Accepted Answer

docker history. The `docker history` command displays the history of a Docker image, showing each layer and the command that created it. This includes the build commands from the Dockerfile, allowing an investigator to see how the container was constructed and what instructions were executed during the build process.

Answer

docker diff

Answer

docker logs

Answer

docker inspect

Question 13

During a forensic investigation of a Microsoft SQL Server, you find the transaction log contains the following: LOP_BEGIN_XACT, LOP_INSERT_ROWS, LOP_COMMIT_XACT for a table named 'CreditCards', with a timestamp just before a known data breach. The log also shows a bulk insert operation. What does this indicate?

Accepted Answer

Data exfiltration via the transaction log. A transaction log showing INSERT operations on a sensitive table, especially with bulk insert, is strong evidence of data exfiltration. The timing and table name suggest unauthorized copying of credit card data.

Answer

A scheduled backup

Answer

A SQL injection attack on the database

Answer

Normal database maintenance

Question 14

During a cloud forensic investigation, an analyst discovers that an AWS EC2 instance was used to launch an attack. The instance has been terminated. Which source is MOST likely to contain evidence of the commands executed on the instance?

Accepted Answer

AWS Systems Manager Agent logs. AWS CloudTrail records API calls for EC2 instance management but not OS-level commands. VPC Flow Logs capture network traffic. EC2 instance metadata is about the instance configuration. AWS Systems Manager Agent (SSM Agent) can log commands executed via AWS Systems Manager, including Run Command, which can capture command history even after instance termination if logs were sent to CloudWatch.

Answer

VPC Flow Logs

Answer

EC2 instance metadata

Answer

AWS CloudTrail logs

Question 15

An email investigator receives a suspicious email and examines the headers. The 'Received-SPF: pass (google.com: domain of example.com designates 203.0.113.5 as permitted sender)' header is present. However, the 'From' address is 'admin@example.com' and the 'Return-Path' is 'admin@example.com'. What does this indicate?

Accepted Answer

The email passed SPF alignment for the domain example.com. The 'Received-SPF: pass' header indicates that the SPF check for the domain in the envelope sender (Return-Path) succeeded, meaning the sending IP (203.0.113.5) was authorized by example.com's SPF record. Since the Return-Path and From address both use 'example.com', SPF alignment is achieved, which is a key requirement for DMARC compliance. Option A is correct because the SPF pass combined with domain alignment confirms the email passed SPF authentication for example.com.

Answer

The email originated from 203.0.113.5

Answer

The email failed SPF check

Answer

The email is definitely legitimate

Question 16

In a Docker container forensics investigation, an analyst needs to examine the file system of a stopped container to look for malicious artifacts. Which command should the analyst run to create a recoverable snapshot of the container's file system without starting the container?

Accepted Answer

docker export <container_id> -o output.tar. `docker export` creates a tar archive of the container's current filesystem, including all layers and changes, without requiring the container to be running. This allows the analyst to obtain a recoverable snapshot of the stopped container's filesystem for offline forensic analysis.

Answer

docker cp <container_id>:/path /host/path

Answer

docker save <image_id> -o output.tar

Answer

docker commit <container_id>

Question 17

A forensic analyst needs to extract email artifacts from a Microsoft Outlook .OST file that is associated with an Exchange account. Which tool is specifically designed to parse and analyze .OST files?

Accepted Answer

Kernel for OST Viewer. Kernel for OST Viewer is a specialized tool designed solely for offline Outlook OST files. While other email forensic tools like Aid4Mail and MailXaminer also support OST, they are general-purpose and handle multiple formats. For the specific requirement of parsing OST files, Kernel for OST Viewer is purpose-built, making it the correct choice.

Answer

Aid4Mail

Answer

EmailTracker Pro

Answer

MailXaminer

Question 18

An investigator examines an email header and sees the following: 'DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; bh=...; h=...; b=...'. The email claims to be from 'support@example.com', but the DKIM signature validation fails. Which of the following is the MOST likely cause?

Accepted Answer

The email was sent from a different domain but the From header was spoofed.. DKIM validation fails when the signature cannot be verified using the public key retrieved for the signing domain (d=example.com). Since the From header also uses example.com, the failure indicates that the email was not genuinely signed by example.com's private key — the email was likely sent from a different domain and the From header was spoofed. The other options are unrelated to DKIM validation.

Answer

The DKIM signature is optional and can be ignored.

Answer

The recipient's email server does not support DKIM.

Answer

The email was encrypted and cannot be verified.

Question 19

Which TWO of the following are valid indicators of email spoofing when analyzing email headers?

Accepted Answer

The 'Received-SPF' header shows 'fail'. SPF failure and a mismatch between Reply-To and From are common signs of spoofing.

Answer

The 'From' header domain matches the 'Return-Path' domain

Answer

The 'DKIM-Signature' header validates successfully

Answer

The 'Message-ID' header contains the sender's IP address

Question 20

A forensic investigator examining a compromised Linux server finds a base64-encoded string in the Apache access log: 'GET /cgi-bin/test.cgi?cmd=ZWNobyAiPD9waHAgc3lzdGVtKCRfR0VUW2NtZF0pOyA/PiI+...' After decoding, the string contains a PHP webshell. Which of the following is the MOST effective method to confirm the webshell was executed on the server?

Accepted Answer

Check the server's process accounting logs (e.g., auditd, 'lastcomm') for PHP process invocation with the cmd parameter. Process accounting logs (e.g., auditd, lastcomm) can confirm that the PHP interpreter was executed on the system, which is direct evidence that the web shell script ran. However, the query string parameter (cmd) is passed via the environment variable QUERY_STRING, not as a command-line argument, so it would not normally appear in process accounting logs. The presence of a PHP process associated with the CGI script is sufficient to verify execution.

Answer

Perform a memory dump of the server and search for the base64 string

Answer

Analyze the MySQL transaction logs for any database queries triggered by the webshell

Answer

Search for the decoded PHP code in the web server's document root