CHFI Application, Email and Cloud Forensics Practice Test 3 — 15 Questions

Question 1

Which of the following tools is specifically designed for parsing and analyzing email headers to detect spoofing and trace the origin of an email?

Accepted Answer

EmailTracker. EmailTracker is a tool that analyzes email headers to track the path of an email and detect spoofing.

Answer

Wireshark

Answer

Volatility

Answer

Sleuth Kit

Question 2

In an Azure environment, an investigator needs to review actions performed by a specific user over the past 30 days. Which Azure service provides the necessary audit logs for this purpose?

Accepted Answer

Azure Activity Log. Azure Activity Logs record all control-plane events (create, update, delete) for Azure resources, including user actions.

Answer

Azure Security Center

Answer

Azure Monitor

Answer

Azure AD Audit Logs

Question 3

A forensic analyst is examining a PST file extracted from a suspect's computer. The analyst wants to recover deleted emails that are no longer visible in the Outlook folder hierarchy. Which approach is most effective?

Accepted Answer

Open the PST in Outlook and check the 'Recoverable Items' folder. Deleted items in PST files may still reside in the 'Deleted Items' folder or be recoverable from the Recoverable Items folder (dumpster) before permanent deletion.

Answer

Perform file carving on the PST file using a forensic tool

Answer

Use a hex editor to manually reconstruct deleted emails

Answer

Use a PST viewer to read the file directly

Question 4

Which of the following is a primary challenge in cloud forensics due to the shared responsibility model?

Accepted Answer

Multi-tenancy and data segregation. In cloud forensics, the shared responsibility model means the cloud provider manages the underlying infrastructure, while the customer controls their data and configurations. Multi-tenancy and data segregation become a primary challenge because forensic investigators must isolate evidence from one tenant without accessing or contaminating data from other tenants, which is complicated by shared physical resources and potential co-mingling of data. This requires careful legal and technical planning to ensure chain of custody and privacy compliance.

Answer

Absence of forensic tools

Answer

Inability to perform network analysis

Answer

Lack of logging capabilities

Question 5

During a database forensic investigation, a MSSQL transaction log analysis reveals a series of INSERT statements that added records to a customer table, followed by a TRUNCATE TABLE statement. What does this pattern most likely indicate?

Accepted Answer

An attacker exfiltrating data and then clearing the table to hide evidence. TRUNCATE TABLE removes all rows and is often used by attackers to cover tracks after exfiltration, while INSERT adds data (possibly exfiltrated or planted).

Answer

A database backup and restore operation

Answer

A scheduled data archiving process

Answer

A DBA testing a new schema

Question 6

A forensic analyst is investigating a web application that was defaced. The Apache access logs show the following entries: (1) GET /cgi-bin/test.cgi HTTP/1.1 with status 200, (2) POST /cgi-bin/test.cgi HTTP/1.1 with status 200, (3) GET /index.html HTTP/1.1 with status 200, (4) GET /images/ HTTP/1.1 with status 301. Which TWO log entries are most suspicious and indicate a likely attack vector?

Accepted Answer

POST /cgi-bin/test.cgi. Entries to /cgi-bin/test.cgi with both GET and POST suggest probing and command execution via CGI. The others are normal traffic.

Answer

GET /index.html

Answer

GET /images/

Answer

All entries are equally suspicious

Question 7

An email investigation reveals that a phishing email was sent from a domain that uses DKIM and SPF. The email headers contain: 'DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; bh=...; h=...; b=...' and 'Received-SPF: pass (example.com: domain of sender@example.com designates 203.0.113.5 as permitted sender)'. Which TWO conclusions can be drawn?

Accepted Answer

The email's DKIM signature is valid. SPF pass indicates the sending IP is authorized; DKIM signature validates the email was signed by the domain. Combined, the email is likely not spoofed.

Answer

The email is definitely legitimate and not spoofed

Answer

The email was sent from a compromised account

Answer

The email originated from a different domain

Question 8

Which tool is specifically designed to analyze email headers, track the path of an email, and extract metadata such as originating IP and authentication results?

Accepted Answer

EmailTracker. EmailTracker is specifically designed to parse email headers, trace the email's path through mail servers, and extract metadata such as the originating IP address, authentication results (SPF, DKIM, DMARC), and timestamps. Unlike general-purpose tools, it focuses solely on email header analysis and visualization, making it the correct choice for this task.

Answer

Volatility

Answer

Wireshark

Answer

FTK Imager

Question 9

An email header contains the following line: "Received: from mail.evil.com (192.0.2.1) by mail.victim.com with ESMTP; Mon, 20 Mar 2023 10:00:00 -0500". The next Received line shows a different IP. What does this indicate?

Accepted Answer

The email is likely spoofed. Discrepancies in the Received headers, especially IP mismatches, are a classic sign of email spoofing where the origin is forged.

Answer

The email's DKIM signature is invalid

Answer

The email was encrypted in transit

Answer

The email was forwarded from another server

Question 10

An investigator needs to recover deleted emails from a Microsoft Outlook PST file. Which forensic technique is most appropriate?

Accepted Answer

Perform file carving on the PST file to recover deleted email fragments. Deleted items in PST files are often recoverable until overwritten; carving can recover remnants.

Answer

Use a hex editor to manually reconstruct the PST headers

Answer

Convert the PST to EML and open each file individually

Answer

Mount the PST file and use Outlook's 'Recover Deleted Items' feature

Question 11

A forensic analyst is investigating a webshell on an IIS server. The access.log shows: 10.0.0.5, -, 12/Mar/2023:14:22:10 +0000, POST /uploads/cmd.aspx, 200, 0, 1234. Which log entry is most indicative of webshell activity?

Accepted Answer

The file path '/uploads/cmd.aspx' and the 200 status code. A POST request to an ASPX file in an uploads directory returning 200 with a small response size and user-agent is suspicious.

Answer

The use of POST method on an ASPX file

Answer

The small response size of 1234 bytes

Answer

The lack of a user-agent in the log

Question 12

An Azure Activity Log shows a suspicious 'Delete Virtual Machine' operation from an IP address in a foreign country. Which THREE actions should the forensic investigator take immediately to preserve evidence and assess impact?

Accepted Answer

Check if the VM's disks have been copied or exported. Option A is correct because checking whether the VM's disks were copied or exported via the Azure portal or CLI (e.g., az disk show / az snapshot list) reveals potential data exfiltration, which is critical for assessing the impact of the suspicious deletion. Option B is correct because isolating the affected VM from the network (e.g., via NSG rules or by disconnecting its NIC) prevents further attacker activity, lateral movement, or command-and-control communication while preserving the VM's runtime state for forensic analysis. Option C is correct because exporting the Activity Log to secure, immutable storage (e.g., an Azure Storage account with immutability policies) preserves the audit trail before default 90-day retention expires and prevents tampering by an attacker with subscription access. Option D is not appropriate immediately because restoring from backup would overwrite or alter the compromised VM's state, destroying volatile and disk-based forensic evidence. Option E is not appropriate as an immediate forensic step because revoking all IAM permissions could disrupt the investigation, lock out legitimate responders, and destroy useful audit data about who had access and when.

Answer

Restore the VM from the latest backup

Answer

Immediately revoke all IAM permissions

Question 13

Which TWO tools are commonly used for email forensic analysis and metadata extraction?

Accepted Answer

Aid4Mail. Aid4Mail (A) is correct because it is a dedicated email forensics and conversion tool that processes mail stores such as PST, OST, MBOX, and EML files, extracting messages, headers, attachments, and metadata for evidentiary review. EmailTracker (D) is correct because it is designed specifically for email tracing and header/metadata analysis, resolving the routing information in message headers (Received, Message-ID, originating IP) to support forensic investigations. Wireshark (B) is a network protocol analyzer that captures live or saved packet traffic, not a tool for parsing stored email files or extracting mailbox metadata, so it does not fit. Volatility (C) is a memory forensics framework for analyzing RAM dumps, which is unrelated to email store parsing. FTK Imager (E) is an imaging and preview tool for disk and memory acquisition, not an email-specific analysis or metadata extraction utility.

Answer

Wireshark

Answer

Volatility

Answer

FTK Imager

Question 14

Which TWO of the following are common challenges in cloud forensics that are not typically encountered in traditional on-premises forensics?

Accepted Answer

Multi-tenancy and co-mingling of data. Multi-tenancy and data jurisdiction are unique to cloud environments. Volatile evidence is a general challenge but not exclusive to cloud. Lack of tools is not a typical challenge. Legal warrants apply to both.

Answer

Difficulty in obtaining search warrants

Answer

Lack of forensic tools for cloud environments

Answer

Volatile evidence that may be lost on system shutdown

Question 15

An incident response team is investigating a breach involving a Docker container. Which THREE of the following actions should the team take to preserve forensic evidence?

Accepted Answer

Use docker export to save the container's filesystem as a tar archive. Creating a container image preserves the filesystem and configuration. Saving logs via docker logs captures runtime output. Exporting the container as a tar archive preserves the filesystem. Inspecting while running is not safe for preservation. Deleting removes evidence.

Answer

Stop the container immediately to prevent further compromise

Answer

Use docker inspect to examine container metadata before stopping