CHFI Application, Email and Cloud Forensics Practice Test 3 — 15 Questions

Question 1

An analyst examines the following Apache access log entry: 192.168.1.10 - - [10/Jan/2023:13:45:22 +0000] "GET /search.php?q=1%27%20UNION%20SELECT%201,2,3-- HTTP/1.1" 200 1234 "-" "Mozilla/5.0". Which attack is MOST likely indicated?

Accepted Answer

SQL Injection. The log shows a UNION SELECT statement in the query parameter, indicating a SQL injection attempt. The URL-encoded single quote (') and comment (--) are classic SQLi payloads.

Answer

Path Traversal

Answer

Cross-Site Scripting (XSS)

Answer

Remote File Inclusion

Question 2

During a forensic investigation of a compromised web server, you find the following entry in the IIS log: 192.168.2.50, -, 10/Jan/2023, 14:32:15, W3SVC1, WEB01, 192.168.2.10, 80, POST, /uploads/shell.aspx, 200, 0, 0, 513, 0, Mozilla/4.0. Which action should the investigator prioritize?

Accepted Answer

Analyze the uploaded shell.aspx file for malicious content. The log shows a POST request to shell.aspx in the uploads directory with a 200 status, indicating a likely webshell upload. The investigator should retrieve and analyze the uploaded file for malicious content to confirm the compromise.

Answer

Rebuild the web server from a clean backup

Answer

Delete the shell.aspx file immediately

Answer

Check the web server's firewall logs for the attacker's IP

Question 3

In a database forensic investigation, you recover a MySQL binary log with the following entry: #230110 13:45:22 server id 1 end_log_pos 123456 Query thread_id=100 exec_time=0 error_code=0 SET TIMESTAMP=1673358322; SELECT * FROM customers INTO OUTFILE '/tmp/export.csv';. What does this indicate?

Accepted Answer

Data exfiltration via the MySQL instance. This log entry records a SELECT ... INTO OUTFILE statement that exports the customers table to a CSV file. This is a common technique for data exfiltration, as it writes data to a file that can be accessed by the attacker.

Answer

A backup operation was performed

Answer

A stored procedure execution

Answer

A SQL injection attack using UNION

Question 4

Which tool is specifically designed for parsing and analyzing email headers to trace the origin of an email and detect spoofing?

Accepted Answer

EmailTrackerPro. EmailTrackerPro is a commercial tool that parses email headers, extracts routing information, and helps detect spoofing by analyzing Received headers and X-Originating-IP.

Answer

Wireshark

Answer

EnCase

Answer

Nmap

Question 5

An email header shows the following Received line: Received: from mail.example.com (192.168.1.1) by smtp.server.com (Postfix). The DKIM-Signature header is missing, and the X-Originating-IP header shows an IP address different from the sender's domain MX record. What is the MOST likely conclusion?

Accepted Answer

The email is likely spoofed. The missing DKIM-Signature and mismatched X-Originating-IP suggest that the email may be spoofed. DKIM provides cryptographic verification; its absence combined with an IP mismatch indicates a lack of authentication and possible forgery.

Answer

The email is legitimate but routed through a different server

Answer

The email was sent from a mobile device

Answer

The email server is misconfigured

Question 6

During a cloud forensic investigation, you review AWS CloudTrail logs and find the following event: {"eventSource":"ec2.amazonaws.com","eventName":"RunInstances","userIdentity":{"arn":"arn:aws:iam::123456789012:user/attacker"},"requestParameters":{"instanceType":"t2.micro","imageId":"ami-0abcdef1234567890"},"responseElements":{"instancesSet":{"items":[{"instanceId":"i-0a1b2c3d4e5f67890"}]}}}. What is the immediate forensic action?

Accepted Answer

Isolate the instance and create a forensic snapshot. The log shows an unauthorized user launched an EC2 instance. The immediate action is to isolate the instance by stopping it or applying a security group to block traffic, preventing further malicious activity while preserving the instance for forensic analysis.

Answer

Delete the instance immediately

Answer

Check the VPC flow logs for network traffic

Answer

Notify the user who launched the instance

Question 7

In Docker forensics, which command is used to view the command history of a container, including how it was built?

Accepted Answer

docker history. The `docker history` command displays the history of a Docker image, showing each layer and the command that created it. This includes the build commands from the Dockerfile, allowing an investigator to see how the container was constructed and what instructions were executed during the build process.

Answer

docker diff

Answer

docker logs

Answer

docker inspect

Question 8

A security analyst finds the following entry in the Apache access log: 10.0.0.5 - - [20/Jan/2023:08:12:44 +0000] "GET /../../../../etc/passwd HTTP/1.1" 404 345 "-" "curl/7.68.0". Which attack was attempted?

Accepted Answer

Path Traversal. The URI contains '../../../../etc/passwd', which is a path traversal attempt to read the /etc/passwd file. The 404 status indicates the file was not found, but the intent is clear.

Answer

Remote File Inclusion

Answer

Command Injection

Answer

Cross-Site Request Forgery (CSRF)

Question 9

Which of the following email headers is used to verify the domain of the sending server and is commonly used for authentication to prevent spoofing?

Accepted Answer

DKIM-Signature. The DKIM-Signature header contains a cryptographic signature that allows the receiver to verify that the email was not modified and is from the claimed domain, helping prevent spoofing.

Answer

Content-Type

Answer

Received

Answer

X-Mailer

Question 10

In cloud forensics, which AWS service logs API calls for governance, compliance, and operational auditing, and is the primary source for detecting unauthorized access?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity in the AWS account, providing logs for security analysis, incident investigation, and compliance auditing.

Answer

AWS Config

Answer

Amazon CloudWatch

Answer

AWS GuardDuty

Question 11

During a forensic investigation of a Microsoft SQL Server, you find the transaction log contains the following: LOP_BEGIN_XACT, LOP_INSERT_ROWS, LOP_COMMIT_XACT for a table named 'CreditCards', with a timestamp just before a known data breach. The log also shows a bulk insert operation. What does this indicate?

Accepted Answer

Data exfiltration via the transaction log. A transaction log showing INSERT operations on a sensitive table, especially with bulk insert, is strong evidence of data exfiltration. The timing and table name suggest unauthorized copying of credit card data.

Answer

A scheduled backup

Answer

A SQL injection attack on the database

Answer

Normal database maintenance

Question 12

In email forensics, which artifact is stored in Outlook's Personal Folders (.pst) files and can be analyzed using tools like Aid4Mail or EmailTracker?

Accepted Answer

Emails, attachments, calendars, contacts, and other mailbox items. .pst files contain emails, attachments, calendars, contacts, and other mailbox items for offline access. Aid4Mail can parse these files for forensic analysis.

Answer

Only the email body text

Answer

Emails and attachments only

Answer

Email headers only

Question 13

Which TWO of the following are common challenges specific to cloud forensics? (Select TWO)

Accepted Answer

Data jurisdiction and legal compliance. Multi-tenancy (shared infrastructure) and data jurisdiction (where data is physically stored) are unique to cloud forensics, unlike physical or virtual environments.

Answer

Volatile memory acquisition

Answer

Inability to image hard drives

Answer

Lack of proper tools

Question 14

Which THREE of the following are indicators of a webshell in web server logs? (Select THREE)

Accepted Answer

POST requests to a script file with large payloads. Webshells are indicated by anomalous script files being accessed, POST requests to script files, and high request rates to a single script. These patterns suggest remote access and command execution.

Answer

Multiple GET requests to /index.html

Answer

Consistent 304 Not Modified responses

Question 15

Which TWO of the following are valid methods to collect logs from Docker containers for forensic analysis? (Select TWO)

Accepted Answer

Using docker logs command to retrieve container logs. The 'docker logs' command captures container stdout/stderr, and the 'docker cp' command can copy log files from the container filesystem. Other methods are not directly applicable.

Answer

Using docker inspect to get log configuration

Answer

Using docker exec to run syslog inside the container

Answer

Using docker image to view the image layers