CHFI Application, Email and Cloud Forensics Practice Test 2 — 15 Questions

Question 1

An analyst examining Apache access logs finds the following entry: 192.168.1.10 - - [10/Oct/2023:13:55:36 -0400] "GET /search.php?q=1'%20OR%20'1'='1 HTTP/1.1" 200 5324 "-" "Mozilla/5.0". Which of the following attacks is MOST likely occurring?

Accepted Answer

SQL injection. The log shows a URI parameter containing SQL injection syntax (1' OR '1'='1). The single quote and OR condition are classic indicators of SQL injection attempts.

Answer

Cross-site scripting (XSS)

Answer

Remote file inclusion

Answer

Path traversal

Question 2

During a forensic investigation of a suspected data breach, you are asked to analyze email headers to trace the origin of a phishing email. Which header field provides the IP address of the sending SMTP server?

Accepted Answer

Received. The Received header is added by each SMTP server that relays the message, showing the IP of the previous hop. The last entry often contains the original sender's IP.

Answer

Message-ID

Answer

DKIM-Signature

Answer

X-Originating-IP

Question 3

A security analyst is investigating a containerized application running on a Docker host. The analyst needs to collect forensic evidence from a stopped container without starting it. Which of the following Docker commands should be used to export the container's filesystem as a tar archive?

Accepted Answer

docker export. docker export exports the container's filesystem as a tar archive. It works on stopped or running containers and does not require the container to be started.

Answer

docker commit

Answer

docker cp

Answer

docker save

Question 4

While investigating a compromised web server, you discover a file named 'shell.php' in the web root. The file contains the following code: <?php system($_GET['cmd']); ?>. Which of the following best describes this file?

Accepted Answer

A web shell. This PHP code executes system commands passed via the 'cmd' GET parameter. This is a classic webshell, allowing remote command execution.

Answer

A SQL injection script

Answer

A file upload vulnerability exploit

Answer

A backdoor trojan

Question 5

An incident responder is analyzing AWS CloudTrail logs to determine if an unauthorized user accessed an S3 bucket. Which of the following CloudTrail event fields should be examined to identify the IAM user or role that made the API call?

Accepted Answer

userIdentity. The userIdentity field contains details about the identity that made the request, including ARN, user name, and type (IAM user, role, etc.).

Answer

sourceIPAddress

Answer

eventSource

Answer

requestParameters

Question 6

A forensic analyst is examining a Microsoft Outlook PST file as part of an email investigation. Which tool is specifically designed to parse and analyze PST files and extract email metadata?

Accepted Answer

Aid4Mail. Aid4Mail is a forensic email analysis tool that supports PST, OST, MBOX, and other formats. It is commonly used for email investigations.

Answer

Wireshark

Answer

EmailTracker

Answer

Sleuth Kit

Question 7

In cloud forensics, one of the major challenges is that data may be stored in multiple jurisdictions with different legal requirements. This challenge is known as:

Accepted Answer

Data jurisdiction. Data jurisdiction refers to the legal and regulatory issues that arise when data is stored or processed across different geographic locations with varying laws.

Answer

Multi-tenancy

Answer

Chain of custody

Answer

Volatile evidence

Question 8

An analyst finds the following entry in an IIS access log: 10.0.0.5, -, 10/10/2023, 14:30:22, W3SVC1, WEB01, 192.168.1.100, 80, GET, /login.aspx, 200, 0, 1234, 567, Mozilla/5.0+. Based on the log format, which field contains the HTTP status code?

Accepted Answer

200. IIS W3C Extended Log Format includes fields: date, time, client IP, cs-uri-stem, sc-status. In the given entry, the status code 200 appears after the URI and before the 0 (sc-substatus).

Answer

GET

Answer

80

Answer

0

Question 9

Which of the following tools is specifically designed to analyze email headers and track the path of an email, providing information about delays and potential spoofing?

Accepted Answer

EmailTracker. EmailTracker is a tool that analyzes email headers, visualizes the path, and helps identify spoofing and delivery delays.

Answer

Wireshark

Answer

FTK Imager

Answer

Autopsy

Question 10

During a database forensic investigation, you need to review Microsoft SQL Server transaction logs to identify unauthorized data modifications. Which of the following SQL Server functions or commands is used to read the transaction log?

Accepted Answer

fn_dblog. fn_dblog is an undocumented function that reads the SQL Server transaction log and returns log records. It is commonly used in forensic analysis.

Answer

SELECT * FROM sys.dm_tran_database_transactions

Answer

DBCC LOG

Answer

BACKUP LOG

Question 11

An analyst is investigating a possible data exfiltration via email. The analyst notices that the email headers contain a DKIM-Signature field that is invalid. Which of the following does a failed DKIM check indicate?

Accepted Answer

The email's content has been modified since it was signed. DKIM provides a digital signature that verifies the email was not tampered with and originates from the claimed domain. A failed DKIM check indicates the email may have been altered or spoofed.

Answer

The email was sent through a proxy server

Answer

The email client does not support DKIM

Answer

The email was sent from a different domain than the one in the From field

Question 12

A forensic investigator needs to collect evidence from a Google Cloud Platform (GCP) environment. Which of the following GCP services provides audit logs for administrative activities and data access?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs in GCP record administrative activities (Admin Activity logs) and data access (Data Access logs) for GCP resources.

Answer

Cloud Storage logs

Answer

Cloud Monitoring

Answer

Cloud IAM

Question 13

Which TWO of the following are common indicators of a path traversal attack found in web server logs? (Select 2)

Accepted Answer

Requests containing '../' sequences. Path traversal attacks use '../' sequences or encoded versions to access files outside the web root. Both options A and B are typical signatures.

Answer

Requests containing a large number of User-Agent strings

Answer

Requests containing '<script>' tags

Answer

Requests containing 'OR 1=1'

Question 14

Which THREE of the following are challenges specific to cloud forensics compared to traditional digital forensics? (Select 3)

Accepted Answer

Data jurisdiction and legal compliance across regions. Cloud forensics involves multi-tenancy (shared resources), data jurisdiction (legal across regions), and volatile evidence (data may be ephemeral). These are distinct from traditional forensics.

Answer

Chain of custody documentation

Answer

Physical access to the hard drive

Question 15

Which TWO of the following are valid email header fields that can be used to detect email spoofing? (Select 2)

Accepted Answer

Received-SPF. SPF and DKIM are email authentication mechanisms that help detect spoofing. SPF checks if the sending server is authorized, DKIM verifies the email integrity.

Answer

Subject

Answer

Content-Type

Answer

MIME-Version