CHFI Application, Email and Cloud Forensics Practice Test 4 — 15 Questions

Question 1

A forensic investigator is analyzing a Linux web server that was compromised through a PHP vulnerability. The attacker uploaded a web shell and executed commands. The investigator needs to determine which command was executed FIRST after the initial compromise. The server uses standard Apache logging with mod_log_config and PHP error logging enabled. Which log source should the investigator examine to find the exact sequence of commands executed by the attacker through the web shell?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Web shell's own log file. The web shell's own log file is the only source that directly records the commands executed through the shell, including their order and arguments. Apache access logs, PHP error logs, and Bash history do not capture this level of detail for non-interactive web shell commands. Thus, examining the web shell's log provides the exact sequence needed.

Answer

PHP error log

Answer

Apache access.log

Answer

Bash history file of the web server user

Question 2

A security analyst reviews an Apache access log entry: 192.168.1.5 - - [10/Jan/2024:08:12:35 +0000] "GET /index.php?id=1 UNION SELECT username,password FROM users-- HTTP/1.1" 200 4321 "-" "Mozilla/5.0". What type of attack is MOST likely indicated?

Accepted Answer

SQL injection. The log entry shows a UNION SELECT statement appended to the id parameter, which is a classic SQL injection attempt.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Remote file inclusion

Question 3

A cloud forensics investigator is analyzing an incident in AWS. The suspect is alleged to have deleted an S3 bucket. Which AWS service log would contain the DeleteBucket API call details, including the source IP and user identity?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including management-plane operations like DeleteBucket. Each CloudTrail event contains the source IP address, user identity (IAM user or role ARN), and the exact API action (DeleteBucket), making it the definitive log for investigating S3 bucket deletion incidents.

Answer

VPC Flow Logs

Answer

Amazon S3 access logs

Answer

AWS Config

Question 4

An investigator examining a compromised web server finds a file named shell.aspx in the uploads directory. The file contains code that accepts commands via HTTP POST and executes them on the server. What is the MOST likely type of attack?

Accepted Answer

Webshell. The file shell.aspx contains code that accepts commands via HTTP POST and executes them on the server, which is the classic definition of a webshell. A webshell is a malicious script uploaded to a web server that provides an attacker with remote command execution capabilities, often used for persistence and post-exploitation activities.

Answer

Server-side request forgery (SSRF)

Answer

SQL injection

Answer

Cross-site request forgery (CSRF)

Question 5

An organization uses Azure. A security analyst needs to investigate a suspicious login event. Which Azure log contains details about user sign-ins, including IP address, timestamp, and success/failure status?

Accepted Answer

Azure AD Sign-in logs. Microsoft Entra ID Sign-in logs (Option B) are the correct source because they specifically capture user authentication events, including the IP address of the client, the exact timestamp of the sign-in attempt, and the success or failure status (e.g., 'Success', 'Failure', 'Interrupted'). This log is part of Microsoft Entra ID's monitoring suite and is designed for identity-related forensic investigations, unlike infrastructure or resource-level logs.

Answer

Azure Monitor Metrics

Answer

Azure Activity Logs

Answer

Azure Security Center alerts

Question 6

In database forensics, which type of log records every transaction (including INSERT, UPDATE, DELETE) and allows reconstruction of database changes over time?

Accepted Answer

Transaction log. Transaction logs (also called redo logs) record all changes to the database, enabling point-in-time recovery and auditing of data modifications.

Answer

Audit log

Answer

Error log

Answer

Slow query log

Question 7

An analyst finds the following in an IIS log: 10.0.0.5, -, 02/15/2024, 14:23:56, GET /../../windows/system32/cmd.exe, 404, 0, 0, 0, Mozilla/4.0. Which attack technique does this log entry represent?

Accepted Answer

Path traversal. The URI contains ../ patterns attempting to access a system file outside the web root, which is path traversal.

Answer

Cross-site scripting

Answer

SQL injection

Answer

Remote code execution

Question 8

During a cloud forensic investigation, the analyst discovers that the suspect used AWS IAM credentials to launch unauthorized EC2 instances. The suspect claims the credentials were stolen. Which log would the analyst examine to determine the source IP address from which the credentials were used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made to the AWS environment, including the `RunInstances` action that launches EC2 instances. Each CloudTrail event contains the `sourceIPAddress` field, which captures the IP address from which the IAM credentials were used. This makes CloudTrail the definitive log to identify the origin of the unauthorized activity.

Answer

VPC Flow Logs

Answer

Amazon Inspector findings

Answer

AWS Config

Question 9

Which TWO pieces of information can be obtained from an email's Received headers to help trace the email's origin? (Select TWO)

Accepted Answer

The IP address of the originating mail server. Option C is correct because Received headers record the connecting host's IP address (typically in the form 'Received: from mail.example.com ([192.0.2.1]) by ...'), which lets an investigator identify the originating mail server and trace the message's path back toward its source. Option E is correct because each Received header includes a date/time stamp showing when that hop processed the message, allowing analysts to reconstruct the chronological relay chain and spot delays or anomalies. The unmarked options do not belong: the DKIM signature hash (A) appears in the DKIM-Signature header, not Received; the sender's email client version (B) is not a standard Received field (it may appear in User-Agent or X-Mailer headers); and the subject line (D) is carried in the Subject header, which is unrelated to routing information.

Answer

The DKIM signature hash

Answer

The sender's email client version

Answer

The subject line of the email

Question 10

Which THREE of the following are common challenges specific to cloud forensics? (Select THREE)

Accepted Answer

Data jurisdiction and legal compliance across regions. Option A is correct because cloud data is stored in provider regions worldwide, so investigators must navigate differing data-protection laws (e.g., GDPR), cross-border legal processes, and jurisdictional conflicts over where evidence resides and who controls it. Option B is correct because auto-scaling, serverless functions, and ephemeral instances can be terminated or recycled at any time, destroying volatile evidence such as RAM contents, running processes, and temporary logs before acquisition can occur. Option C is correct because in cloud environments the customer has no physical access to the underlying hardware; forensic acquisition must rely on provider-mediated methods like VM snapshots, EBS volume copies, or APIs rather than seizing physical hard drives. Option D is not a cloud-specific challenge, since inconsistent log formats are a general logging issue across on-premises and cloud systems rather than unique to cloud forensics. Option E is not a cloud-specific challenge either, as the cost of forensic tools applies broadly to all digital investigations and is not an inherent characteristic of cloud computing.

Answer

Lack of standardized log formats

Answer

High cost of forensic tools

Question 11

Which TWO of the following are indicators of a webshell attack found in web server logs? (Select TWO)

Accepted Answer

Requests to a .asp or .php file with parameters like cmd or exec. Option C is correct because webshells are typically small scripts (e.g., .asp, .php, .jsp) that accept command parameters such as cmd, exec, or shell, so log entries showing requests to such files with those parameter names are a strong indicator of command execution through a webshell. Option E is correct because attackers commonly upload a webshell into a writable upload directory and then interact with it via POST requests, so repeated POSTs to a script in an upload folder in the web logs is a classic webshell traffic pattern. Option A is not specific to webshells, since OPTIONS and TRACE are legitimate HTTP methods and their presence alone does not indicate a webshell. Option B is too generic, as high traffic from one IP can result from many benign causes such as crawlers, load balancers, or DoS activity. Option D is also non-specific, because frequent 404 errors usually indicate broken links, scanning, or enumeration rather than webshell command execution.

Answer

Abnormal HTTP methods like OPTIONS or TRACE

Answer

High volume of traffic from a single IP

Answer

Frequent 404 errors for non-existent pages

Question 12

An analyst examining Apache access logs finds the following entry: 192.168.1.10 - - [10/Oct/2023:13:55:36 -0400] "GET /search.php?q=1'%20OR%20'1'='1 HTTP/1.1" 200 5324 "-" "Mozilla/5.0". Which of the following attacks is MOST likely occurring?

Accepted Answer

SQL injection. The log entry shows a GET request to /search.php with a query parameter q containing the SQL injection payload 1' OR '1'='1. This classic tautology-based SQL injection attempts to manipulate the SQL query to always return true, potentially bypassing authentication or extracting data. The 200 OK response and 5324 bytes indicate the server processed the malicious input, confirming the attack is SQL injection.

Answer

Cross-site scripting (XSS)

Answer

Remote file inclusion

Answer

Path traversal

Question 13

A security analyst is investigating a containerized application running on a Docker host. The analyst needs to collect forensic evidence from a stopped container without starting it. Which of the following Docker commands should be used to export the container's filesystem as a tar archive?

Accepted Answer

docker export. The `docker export` command creates a tar archive of a container's filesystem, even if the container is stopped, without starting it. This is the correct tool for extracting forensic evidence from a stopped container's filesystem as a single archive file.

Answer

docker commit

Answer

docker cp

Answer

docker save

Question 14

While investigating a compromised web server, you discover a file named 'shell.php' in the web root. The file contains the following code: <?php system($_GET['cmd']); ?>. Which of the following best describes this file?

Accepted Answer

A web shell. The file 'shell.php' contains code that uses the PHP system() function to execute arbitrary operating system commands passed via the 'cmd' GET parameter. This is the classic definition of a web shell, which provides remote command execution on the server. It is not a SQL injection script, a file upload exploit, or a trojan in the traditional sense, as it directly accepts and runs system commands through HTTP requests.

Answer

A SQL injection script

Answer

A file upload vulnerability exploit

Answer

A backdoor trojan

Question 15

An incident responder is analyzing AWS CloudTrail logs to determine if an unauthorized user accessed an S3 bucket. Which of the following CloudTrail event fields should be examined to identify the IAM user or role that made the API call?

Accepted Answer

userIdentity. The userIdentity field contains details about the identity that made the request, including ARN, user name, and type (IAM user, role, etc.).

Answer

sourceIPAddress

Answer

eventSource

Answer

requestParameters