CHFI Application, Email and Cloud Forensics Practice Test 4 — 15 Questions

Question 1

A security analyst reviews an Apache access log and finds the entry: '192.168.1.10 - - [10/Mar/2025:08:12:34 +0000] "GET /index.php?id=1 UNION SELECT username,password FROM users-- HTTP/1.1" 200 2345 "-" "Mozilla/5.0"'. Which attack is indicated?

Accepted Answer

SQL injection. The UNION SELECT statement in the URI indicates a SQL injection attack. The attacker is trying to extract data from the database.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Webshell upload

Question 2

Which email header field is MOST reliable for identifying the true origin of an email, assuming no header tampering occurred at the initial MTA?

Accepted Answer

Received. The Received header chain shows the path the email took. The last Received header (from the originating server) is the most reliable for identifying the original sender's IP.

Answer

Message-ID

Answer

From

Answer

DKIM-Signature

Question 3

During a cloud forensic investigation, an analyst discovers that an AWS EC2 instance was used to launch an attack. The instance has been terminated. Which source is MOST likely to contain evidence of the commands executed on the instance?

Accepted Answer

AWS Systems Manager Agent logs. AWS CloudTrail records API calls for EC2 instance management but not OS-level commands. VPC Flow Logs capture network traffic. EC2 instance metadata is about the instance configuration. AWS Systems Manager Agent (SSM Agent) can log commands executed via AWS Systems Manager, including Run Command, which can capture command history even after instance termination if logs were sent to CloudWatch.

Answer

VPC Flow Logs

Answer

EC2 instance metadata

Answer

AWS CloudTrail logs

Question 4

An analyst examining an Outlook PST file wants to recover deleted emails that are no longer visible in the Deleted Items folder. Which technique is MOST effective?

Accepted Answer

Use a forensic tool to carve for deleted items within the PST. Deleted emails in PST files are often not immediately overwritten. Using forensic tools to scan the PST file for unallocated space or deleted items can recover them.

Answer

Convert the PST to an EDB file and mount it

Answer

Repair the PST file using Scanpst.exe

Answer

Reconstruct the PST from the Exchange server backup

Question 5

A web server log shows the following request: 'GET /../../../../etc/passwd HTTP/1.1' with a 200 response code. The web server is running Apache on Linux. What attack has likely succeeded?

Accepted Answer

Local File Inclusion (LFI) or Path Traversal. The '../' sequences indicate path traversal, attempting to access files outside the web root. A 200 response suggests the file was served.

Answer

Remote File Inclusion (RFI)

Answer

SQL injection

Answer

Cross-Site Request Forgery (CSRF)

Question 6

Which cloud forensic challenge refers to the inability to physically access the storage media where data resides?

Accepted Answer

Lack of physical access. Volatility of evidence relates to the ephemeral nature of cloud data. Multi-tenancy is about shared resources. Data jurisdiction is legal. Lack of physical access is a key challenge.

Answer

Data jurisdiction

Answer

Multi-tenancy

Answer

Volatility of evidence

Question 7

A forensic analyst is investigating a Docker container that was used to launch a network attack. The container has been stopped but not removed. Which action should the analyst take FIRST to preserve volatile evidence?

Accepted Answer

Use 'docker commit' to create an image of the container. Preserving the container's file system and logs is key. 'docker commit' creates an image from the container's current state. 'docker export' exports the filesystem as a tar archive. 'docker logs' retrieves logs. 'docker inspect' shows metadata. The container is stopped, so 'docker exec' won't work without starting it, which alters state. 'docker save' saves images, not containers. The best first step is to create an image or export the filesystem.

Answer

Restart the container and use 'docker exec' to collect evidence

Answer

Use 'docker inspect' to view container metadata only

Answer

Use 'docker save' to export the container as a tar file

Question 8

An email investigator receives a suspicious email and examines the headers. The 'Received-SPF: pass (google.com: domain of example.com designates 203.0.113.5 as permitted sender)' header is present. However, the 'From' address is 'admin@example.com' and the 'Return-Path' is 'admin@example.com'. What does this indicate?

Accepted Answer

The email passed SPF alignment for the domain example.com. SPF check passed for the domain example.com, meaning the sending server (203.0.113.5) is authorized. This suggests the email is not spoofed from that domain, at least from SPF perspective.

Answer

The email originated from 203.0.113.5

Answer

The email failed SPF check

Answer

The email is definitely legitimate

Question 9

Which tool is specifically designed to analyze email headers and track the path of an email across multiple servers?

Accepted Answer

EmailTracker. EmailTracker is a web-based tool that parses email headers and visualizes the route. Aid4Mail is for forensic acquisition/analysis. Wireshark captures network packets. FTK Imager is for disk imaging.

Answer

Aid4Mail

Answer

Wireshark

Answer

FTK Imager

Question 10

A forensic analyst is investigating a MySQL database server breach. Which log is MOST useful for identifying a series of queries that exfiltrated data, assuming the attacker used a compromised application account?

Accepted Answer

General query log. MySQL general query log logs all queries, but can be resource-intensive. Binary logs record changes. Error logs contain errors. Slow query log logs slow queries. The general query log is best for seeing all queries from a compromised account.

Answer

Binary log

Answer

Slow query log

Answer

Error log

Question 11

An analyst discovers a suspicious file named 'cmd.aspx' in the uploads directory of an IIS web server. Analysis reveals the file contains code to execute system commands. What is this file most likely?

Accepted Answer

A web shell. A file with .aspx extension that executes commands is a webshell, allowing remote command execution on the server.

Answer

A log file

Answer

A benign configuration file

Answer

A backup of a legitimate page

Question 12

Which Azure log source should an investigator query to identify who deleted a virtual machine and when?

Accepted Answer

Azure Activity Log. Azure Activity Log (now called Monitor Activity Log) records control-plane operations like VM deletion. Azure AD logs are for authentication. NSG flow logs are for network traffic. Diagnostic settings for VMs capture OS-level logs.

Answer

Azure Active Directory sign-in logs

Answer

Azure Diagnostic Settings for the VM

Answer

Network Security Group flow logs

Question 13

A security analyst is investigating a phishing email and notices the DKIM-Signature header is present but fails validation. Which TWO actions should the analyst take?

Accepted Answer

Check the DKIM DNS record for the signing domain. DKIM failure indicates the email may be forged or tampered with. Checking the domain's DKIM DNS record and examining the email headers for other spoofing indicators are appropriate steps.

Answer

Ignore the DKIM failure as it is not important

Answer

Reply to the sender to verify authenticity

Answer

Delete the email immediately

Question 14

A cloud forensic investigator is analyzing a GCP audit log entry for a Compute Engine instance. Which THREE fields are essential for identifying the user and operation performed?

Accepted Answer

methodName. GCP audit logs include the principal email (authenticationInfo), operation type (methodName), and resource name (resourceName). IP address and user agent may be in requestMetadata but not always in every log entry.

Answer

requestMetadata.callerIp

Answer

requestMetadata.userAgent

Question 15

A forensic analyst is examining a Docker container image for malware. Which TWO techniques can help analyze the image layers?

Accepted Answer

Use 'docker history' to view the build history of the image. 'docker history' shows the build commands and layers, which helps identify suspicious steps. 'docker export' exports the container filesystem but not layers individually. 'docker save' saves the image as a tar, allowing layer extraction. 'docker inspect' shows metadata only. 'docker images' lists images.

Answer

Use 'docker images' to list all images

Answer

Use 'docker inspect' to view the image metadata

Answer

Use 'docker export' on a running container