CHFI Application, Email and Cloud Forensics Practice Test 10 — 15 Questions

Question 1

A security analyst reviewing Apache access logs finds entries like: 192.168.1.10 - - [12/Jan/2023:15:23:11 +0000] "GET /search?q=1' OR '1'='1 HTTP/1.1" 200 5324. What attack is indicated?

Accepted Answer

SQL injection. The log entry shows a SQL injection attempt via the 'q' parameter with a tautology. The 200 response indicates the request was processed, suggesting possible success.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Command injection

Question 2

Which tool is specifically designed to analyze email headers, track the path of an email, and extract metadata such as originating IP and authentication results?

Accepted Answer

EmailTracker. EmailTracker is specifically designed to parse email headers, trace the email's path through mail servers, and extract metadata such as the originating IP address, authentication results (SPF, DKIM, DMARC), and timestamps. Unlike general-purpose tools, it focuses solely on email header analysis and visualization, making it the correct choice for this task.

Answer

Volatility

Answer

Wireshark

Answer

FTK Imager

Question 3

During a cloud forensics investigation, an analyst examines AWS CloudTrail logs and finds an event with "userIdentity":{"type":"AssumedRole","arn":"arn:aws:sts::123456789012:assumed-role/AdminRole/i-0abcd1234efgh5678"}. What does the 'i-0abcd1234efgh5678' portion most likely represent?

Accepted Answer

The session name, which is typically the EC2 instance ID. In CloudTrail, when an EC2 instance assumes a role, the session name is often the instance ID. The 'i-' prefix and alphanumeric string indicate an EC2 instance ID.

Answer

The AWS account ID of the role's trusted entity

Answer

The role's unique identifier assigned by IAM

Answer

The unique ID of the IAM user who assumed the role

Question 4

An email header contains the following line: "Received: from mail.evil.com (192.0.2.1) by mail.victim.com with ESMTP; Mon, 20 Mar 2023 10:00:00 -0500". The next Received line shows a different IP. What does this indicate?

Accepted Answer

The email is likely spoofed. Discrepancies in the Received headers, especially IP mismatches, are a classic sign of email spoofing where the origin is forged.

Answer

The email's DKIM signature is invalid

Answer

The email was encrypted in transit

Answer

The email was forwarded from another server

Question 5

In Docker forensics, which of the following commands would you use to inspect the history of an image, including the commands that created each layer?

Accepted Answer

docker history. The 'docker history' command shows the history of an image, listing each layer and the command that created it.

Answer

docker image ls

Answer

docker logs

Answer

docker inspect

Question 6

An investigator needs to recover deleted emails from a Microsoft Outlook PST file. Which forensic technique is most appropriate?

Accepted Answer

Perform file carving on the PST file to recover deleted email fragments. Deleted items in PST files are often recoverable until overwritten; carving can recover remnants.

Answer

Use a hex editor to manually reconstruct the PST headers

Answer

Convert the PST to EML and open each file individually

Answer

Mount the PST file and use Outlook's 'Recover Deleted Items' feature

Question 7

A forensic analyst is investigating a webshell on an IIS server. The access.log shows: 10.0.0.5, -, 12/Mar/2023:14:22:10 +0000, POST /uploads/cmd.aspx, 200, 0, 1234. Which log entry is most indicative of webshell activity?

Accepted Answer

The file path '/uploads/cmd.aspx' and the 200 status code. A POST request to an ASPX file in an uploads directory returning 200 with a small response size and user-agent is suspicious.

Answer

The use of POST method on an ASPX file

Answer

The small response size of 1234 bytes

Answer

The lack of a user-agent in the log

Question 8

Which cloud service log is most appropriate for tracking API calls and resource changes in an AWS environment?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity and resource changes.

Answer

AWS VPC Flow Logs

Answer

AWS Config

Answer

AWS CloudWatch Logs

Question 9

A forensic analyst is examining MySQL binary logs to identify a data exfiltration event. Which TWO fields are most critical for reconstructing the stolen data?

Accepted Answer

Timestamp. The SQL statement reveals what data was retrieved, and the timestamp helps establish the timeline.

Answer

Error code

Answer

Server ID

Answer

Thread ID

Question 10

An Azure Activity Log shows a suspicious 'Delete Virtual Machine' operation from an IP address in a foreign country. Which THREE actions should the forensic investigator take immediately to preserve evidence and assess impact?

Accepted Answer

Check if the VM's disks have been copied or exported. Isolating the VM, exporting the Activity Log, and checking for data backups are critical steps to preserve evidence.

Answer

Restore the VM from the latest backup

Answer

Immediately revoke all IAM permissions

Question 11

A security analyst notices repeated entries in an IIS log: 10.0.0.2, -, 05/Feb/2023:08:12:34 +0000, GET /../../windows/system32/config/sam, 404, 0, 532. Which TWO of the following attack types are indicated by this log entry?

Accepted Answer

Directory traversal. The use of '../' indicates path traversal, and the target file (SAM) is a common target for privilege escalation.

Answer

SQL injection

Answer

Denial of service

Answer

Cross-site scripting

Question 12

Which TWO tools are commonly used for email forensic analysis and metadata extraction?

Accepted Answer

Aid4Mail. Aid4Mail and EmailTracker are specialized for email forensics.

Answer

Wireshark

Answer

Volatility

Answer

FTK Imager

Question 13

A Docker container is suspected of malicious activity. Which THREE data sources should the investigator collect for forensic analysis?

Accepted Answer

Host system audit logs. Container logs, image layers, and host system logs are key sources in Docker forensics.

Answer

Network packet captures from the container's virtual interface

Answer

The Dockerfile used to build the image

Question 14

A GCP audit log shows a project owner granted 'iam.serviceAccountUser' role to a service account from a different project. Which TWO potential security implications should the investigator prioritize?

Accepted Answer

The service account can be used to escalate privileges by attaching it to resources. This privilege escalation allows the service account to impersonate other accounts and potentially access resources across projects.

Answer

The audit logging is now disabled for that service account

Answer

The service account's keys are automatically rotated

Answer

The service account can now impersonate any user in the project

Question 15

Which TWO of the following are common challenges specific to cloud forensics?

Accepted Answer

Multi-tenancy issues. Multi-tenancy complicates data isolation, and data jurisdiction affects legal access to data across regions.

Answer

Inability to create disk images

Answer

Permanent data deletion recovery

Answer

Lack of forensic tools