CHFI Application, Email and Cloud Forensics Practice Test 2 — 15 Questions

Question 1

In a Docker container forensics investigation, an analyst needs to examine the file system of a stopped container to look for malicious artifacts. Which command should the analyst run to create a recoverable snapshot of the container's file system without starting the container?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

docker export <container_id> -o output.tar. `docker export` creates a tar archive of the container's current filesystem, including all layers and changes, without requiring the container to be running. This allows the analyst to obtain a recoverable snapshot of the stopped container's filesystem for offline forensic analysis.

Answer

docker cp <container_id>:/path /host/path

Answer

docker save <image_id> -o output.tar

Answer

docker commit <container_id>

Question 2

A forensic analyst needs to extract email artifacts from a Microsoft Outlook .OST file that is associated with an Exchange account. Which tool is specifically designed to parse and analyze .OST files?

Accepted Answer

Kernel for OST Viewer. Kernel for OST Viewer is a specialized tool designed solely for offline Outlook OST files. While other email forensic tools like Aid4Mail and MailXaminer also support OST, they are general-purpose and handle multiple formats. For the specific requirement of parsing OST files, Kernel for OST Viewer is purpose-built, making it the correct choice.

Answer

Aid4Mail

Answer

EmailTracker Pro

Answer

MailXaminer

Question 3

An investigator examines an email header and sees the following: 'DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; bh=...; h=...; b=...'. The email claims to be from 'support@example.com', but the DKIM signature validation fails. Which of the following is the MOST likely cause?

Accepted Answer

The email was sent from a different domain but the From header was spoofed.. DKIM validation fails when the signature cannot be verified using the public key retrieved for the signing domain (d=example.com). Since the From header also uses example.com, the failure indicates that the email was not genuinely signed by example.com's private key — the email was likely sent from a different domain and the From header was spoofed. The other options are unrelated to DKIM validation.

Answer

The DKIM signature is optional and can be ignored.

Answer

The recipient's email server does not support DKIM.

Answer

The email was encrypted and cannot be verified.

Question 4

Which TWO of the following are valid indicators of email spoofing when analyzing email headers?

Accepted Answer

The 'Received-SPF' header shows 'fail'. SPF failure and a mismatch between Reply-To and From are common signs of spoofing.

Answer

The 'From' header domain matches the 'Return-Path' domain

Answer

The 'DKIM-Signature' header validates successfully

Answer

The 'Message-ID' header contains the sender's IP address

Question 5

A forensic investigator examining a compromised Linux server finds a base64-encoded string in the Apache access log: 'GET /cgi-bin/test.cgi?cmd=ZWNobyAiPD9waHAgc3lzdGVtKCRfR0VUW2NtZF0pOyA/PiI+...' After decoding, the string contains a PHP webshell. Which of the following is the MOST effective method to confirm the webshell was executed on the server?

Accepted Answer

Check the server's process accounting logs (e.g., auditd, 'lastcomm') for PHP process invocation with the cmd parameter. Process accounting logs (e.g., auditd, lastcomm) can confirm that the PHP interpreter was executed on the system, which is direct evidence that the web shell script ran. However, the query string parameter (cmd) is passed via the environment variable QUERY_STRING, not as a command-line argument, so it would not normally appear in process accounting logs. The presence of a PHP process associated with the CGI script is sufficient to verify execution.

Answer

Perform a memory dump of the server and search for the base64 string

Answer

Analyze the MySQL transaction logs for any database queries triggered by the webshell

Answer

Search for the decoded PHP code in the web server's document root

Question 6

Which tool is specifically designed to extract and analyze metadata from email messages, including headers, attachments, and embedded objects, for forensic investigations?

Accepted Answer

EmailTracker. EmailTracker is a tool that parses email headers and extracts metadata for forensic analysis, such as tracking the path of an email.

Answer

FTK Imager

Answer

Wireshark

Answer

Sleuth Kit

Question 7

A forensic examiner is investigating a Docker container suspected of being used for malicious activity. Which of the following is the BEST approach to collect volatile evidence from the container without altering its state?

Accepted Answer

Create a memory dump of the host machine and extract container memory. Creating a memory dump of the host machine and then extracting the container's memory from that dump captures volatile evidence (e.g., running processes, memory contents) without altering the container's state. 'docker commit' only captures the filesystem, not memory. Stopping the container destroys volatile data. 'docker exec' alters the container's state by running commands inside it.

Answer

Stop the container immediately and then export its filesystem with 'docker export'

Answer

Use 'docker commit' to create an image of the container's current state

Answer

Execute 'docker exec' to access the container shell and run forensic tools

Question 8

An investigator needs to analyze a Microsoft Outlook PST file from a suspect's computer. Which of the following tools is specifically designed for parsing and extracting emails, attachments, and metadata from PST files in a forensically sound manner?

Accepted Answer

Aid4Mail. Aid4Mail is a forensic email analysis tool specifically designed to parse and extract emails, attachments, and metadata from PST files in a forensically sound manner. It preserves original metadata (e.g., headers, timestamps, MIME structure) and generates hash-verified exports, making it suitable for legal proceedings. Unlike generic email viewers, Aid4Mail maintains chain of custody and supports forensic imaging of PST containers.

Answer

DBXtract

Answer

MailXaminer

Answer

OutlookSpy

Question 9

An analyst is investigating a data exfiltration incident. The MySQL transaction logs show a series of unusual SELECT queries retrieving large amounts of data from the 'customers' table, executed by a user account 'webapp'. What should the analyst check NEXT to determine if the data was actually exfiltrated?

Accepted Answer

Review the web server access logs for requests to external IPs containing the queried data. After identifying suspicious queries, the analyst should check the application server logs to see if the results were sent externally.

Answer

Examine the database schema for unauthorized stored procedures

Answer

Analyze the MySQL audit logs for privilege escalation attempts

Answer

Check the MySQL binary logs for any DELETE or DROP statements

Question 10

In an email forensics investigation, which THREE indicators suggest that an email is likely spoofed? (Select THREE.)

Accepted Answer

The 'DKIM-Signature' header is missing or fails validation. Spoofed emails often fail SPF checks, have no DKIM signature (or a failed one), and may contain mismatched headers like From vs. Return-Path.

Answer

The 'Received-SPF' header shows 'pass'

Answer

The 'From' domain matches the 'Return-Path' domain

Question 11

A security analyst is investigating a potential container escape from a Docker container. Which THREE artifacts should the analyst collect to analyze the incident? (Select THREE.)

Accepted Answer

Host system's audit logs (e.g., /var/log/auth.log). Option A is correct because the host's audit logs such as /var/log/auth.log record authentication and privilege-escalation events on the host, which can reveal whether the container escape led to host-level logins or sudo/root activity. Option C is correct because the container image layers from the registry preserve the exact filesystem contents and configuration the container was built from, allowing the analyst to identify malicious binaries, altered entrypoints, or vulnerable packages that enabled the escape. Option E is correct because Docker daemon logs (e.g., journalctl -u docker) capture container lifecycle events, privileged flag usage, volume mounts, and exec/attach activity that are essential for reconstructing how the escape occurred. Option B does not belong because captures from the host's physical NIC are not container-specific and would not directly show intra-host container-to-host escape activity. Option D does not belong because a container's memory dump is volatile and typically unavailable after the fact unless pre-configured, and it is not one of the standard artifacts for this scenario.

Answer

Network traffic captures from the host's physical NIC

Answer

Container's memory dump

Question 12

During a Docker forensics investigation, an analyst needs to identify the commands executed within a deleted container. Which of the following approaches is MOST effective to retrieve this information?

Accepted Answer

Search the host filesystem for the container's log files in /var/lib/docker/containers. Docker stores container logs in JSON files on the host. Even after a container is removed, its logs may remain on the host filesystem under /var/lib/docker/containers until cleaned. Inspecting image layers only shows filesystem changes, not runtime commands.

Answer

Check the Docker daemon logs for container start/stop events

Answer

Use `docker inspect` on the container ID

Answer

Examine the container's image layers using `docker history`

Question 13

A security analyst reviews the following Apache access log entry: 192.168.1.10 - - [15/May/2025:10:15:23 +0000] "GET /search.php?q=1'%20OR%20'1'='1 HTTP/1.1" 200 5321 "-" "Mozilla/5.0". Which type of attack is most likely indicated?

Accepted Answer

SQL injection (SQLi). The log entry shows a GET request to /search.php with the parameter q containing the payload 1' OR '1'='1. This is a classic SQL injection (SQLi) attempt, where the attacker injects a tautology (OR '1'='1') to manipulate the SQL query's WHERE clause, potentially bypassing authentication or extracting data. The URL-encoded single quote (%27) and the OR condition are definitive indicators of SQLi.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Remote file inclusion

Question 14

A forensic analyst is examining Docker container logs and finds a container that ran the command 'rm -rf /' and then stopped. The container was based on a custom image. Which of the following is the most effective way to recover deleted files from the container's filesystem?

Accepted Answer

Recover files from the image layers using 'docker history' and 'docker export'. Docker images consist of immutable layers. When files are deleted in a container, whiteout files are placed in the writable layer, but the original data remains in the underlying image layers. To recover the original files, the analyst should access the image layers directly, for example by using 'docker save' to export the image as a tar archive preserving all layers. 'docker history' can reveal layer IDs, but 'docker export' on a container applies whiteouts and will not recover the deleted files. Therefore, none of the provided options correctly describes the recovery method.

Answer

Restore the container from a backup snapshot

Answer

Use data carving tools on the container's writable layer

Answer

Run 'docker commit' to create an image from the container and then extract files

Question 15

A forensic analyst is reviewing Microsoft IIS logs and finds the entry: 192.168.1.50, -, 10/Feb/2025:14:22:10 +0000, GET /scripts/..%c1%af../winnt/system32/cmd.exe, 404. Which attack technique is indicated by the encoded characters in the URI?

Accepted Answer

Path traversal attack using Unicode encoding. The encoded characters %c1%af in the URI represent a Unicode (UTF-8) overlong encoding of the forward slash character (/). This is a classic path traversal attack (also known as directory traversal) designed to bypass input validation filters that block standard '../' sequences. The request attempts to access cmd.exe in the Windows system directory, which is a common post-exploitation target. The 404 response indicates the server rejected or did not find the resource, but the attack technique is clearly path traversal using Unicode encoding.

Answer

Directory listing attempt

Answer

SQL injection (SQLi)

Answer

Cross-site scripting (XSS)