CHFI Application, Email and Cloud Forensics Practice Test 5 — 15 Questions

Question 1

During a forensic investigation of a compromised web server, an analyst examines the Apache access log and finds the following entry: '192.168.1.10 - - [12/Oct/2024:13:45:22 +0000] "GET /index.php?id=1 UNION SELECT username, password FROM users-- HTTP/1.1" 200 1234 "-" "Mozilla/5.0"'. What type of attack is MOST likely indicated?

Accepted Answer

SQL injection (SQLi). The log entry contains 'UNION SELECT username, password FROM users--', which is a SQL injection attempt to retrieve data from the users table.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Remote file inclusion (RFI)

Question 2

An email forensic analyst receives a suspicious email and examines the full headers. Which header field is the MOST reliable for determining the true originating IP address of the sender, assuming no spoofing of the header?

Accepted Answer

Received. The Received headers are added by each SMTP server; the first Received header (bottommost) contains the IP of the originating server.

Answer

Return-Path

Answer

Message-ID

Answer

From

Question 3

In a Docker container forensics investigation, an analyst needs to examine the file system of a stopped container to look for malicious artifacts. Which command should the analyst run to create a recoverable snapshot of the container's file system without starting the container?

Accepted Answer

docker export <container_id> -o output.tar. docker export captures the file system of a stopped container as a tar archive for forensic analysis.

Answer

docker cp <container_id>:/path /host/path

Answer

docker save <image_id> -o output.tar

Answer

docker commit <container_id>

Question 4

A cloud forensic investigator is examining AWS CloudTrail logs for signs of unauthorized access to an S3 bucket. Which of the following CloudTrail event names would indicate a successful attempt to list the objects in the bucket?

Accepted Answer

ListObjects. The ListObjects operation lists the objects in an S3 bucket; the CloudTrail event name is 'ListObjects'.

Answer

GetObject

Answer

PutObject

Answer

DeleteObject

Question 5

An investigator is analyzing a compromised MySQL database server. To determine the exact time and content of a suspect data exfiltration query, which MySQL log should be examined first, assuming it is enabled?

Accepted Answer

General query log. The general query log captures every SQL statement, including SELECT queries, making it ideal for identifying data exfiltration.

Answer

Error log

Answer

Binary log

Answer

Slow query log

Question 6

A forensic analyst needs to extract email artifacts from a Microsoft Outlook .OST file that is associated with an Exchange account. Which tool is specifically designed to parse and analyze .OST files?

Accepted Answer

Kernel for OST Viewer. Kernel for OST Viewer is specifically designed to parse offline Outlook data files (.OST).

Answer

Aid4Mail

Answer

EmailTracker Pro

Answer

MailXaminer

Question 7

During a forensic investigation of a Google Cloud Platform (GCP) environment, an analyst reviews Audit Logs and sees a log entry with the method 'storage.objects.list' and a principal email 'attacker@gmail.com'. However, the identity is not from the organization's domain. What should the analyst conclude?

Accepted Answer

An external identity was granted IAM permissions on the bucket, possibly through a misconfigured resource.. An external principal appearing in the log indicates that the bucket's IAM policy allowed access from outside the organization, a common misconfiguration.

Answer

The analyst must immediately shut down the bucket.

Answer

The attacker spoofed the principal email in the log.

Answer

The log entry is a false positive due to a logging error.

Question 8

An investigator examines an email header and sees the following: 'DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; bh=...; h=...; b=...'. The email claims to be from 'support@example.com', but the DKIM signature validation fails. Which of the following is the MOST likely cause?

Accepted Answer

The email was sent from a different domain but the From header was spoofed.. DKIM uses a digital signature to verify the email's domain. Validation failure strongly suggests the email was not sent by the legitimate domain, indicating spoofing.

Answer

The DKIM signature is optional and can be ignored.

Answer

The recipient's email server does not support DKIM.

Answer

The email was encrypted and cannot be verified.

Question 9

Which tool is commonly used to analyze email headers and trace the path of an email across servers by parsing 'Received' fields?

Accepted Answer

EmailTrackerPro. EmailTrackerPro is specifically designed to analyze email headers and trace the path of an email.

Answer

Wireshark

Answer

Volatility

Answer

FTK Imager

Question 10

In an Azure environment, a forensic analyst needs to identify which user assigned a specific role to another user, leading to privilege escalation. Which Azure log should the analyst examine?

Accepted Answer

Azure Activity Log. Azure Activity Log captures all write operations (PUT, POST, DELETE) on Azure resources, including role assignments, making it the primary source for investigating privilege escalation.

Answer

Azure AD Sign-In Logs

Answer

Azure Diagnostic Logs

Answer

Azure Network Watcher Logs

Question 11

An analyst discovers a suspicious file named 'cmd.aspx' in the web root of an IIS server. The file contains ASPX code that executes system commands. The IIS logs show a POST request to '/cmd.aspx' with a 200 status code. Which type of attack is indicated?

Accepted Answer

Webshell upload. A webshell is a script that provides a backdoor for remote administration. The presence of 'cmd.aspx' in the web root with command execution capability confirms a webshell attack.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Question 12

Which of the following is a primary challenge in cloud forensics due to the shared responsibility model?

Accepted Answer

Inability to perform live acquisition of volatile data without cooperation from the cloud provider. The shared responsibility model means the cloud provider controls the infrastructure, limiting the investigator's ability to acquire volatile data without provider support.

Answer

Data is always stored in a single jurisdiction

Answer

Lack of encryption support

Answer

Cloud logs are immutable and cannot be altered

Question 13

Which TWO of the following are valid indicators of email spoofing when analyzing email headers?

Accepted Answer

The 'Received-SPF' header shows 'fail'. SPF failure and a mismatch between Reply-To and From are common signs of spoofing.

Answer

The 'From' header domain matches the 'Return-Path' domain

Answer

The 'DKIM-Signature' header validates successfully

Answer

The 'Message-ID' header contains the sender's IP address

Question 14

Which THREE of the following are challenges specific to container forensics?

Accepted Answer

Ephemeral nature of containers: containers are often short-lived and can be deleted quickly. The ephemeral nature, layered file systems, and shared kernel are key challenges in container forensics.

Answer

Containers cannot be imaged using standard forensic tools

Answer

Container logs are always stored in a centralized location

Question 15

Which TWO of the following are appropriate techniques for identifying a webshell on a compromised web server?

Accepted Answer

Searching for files with recent creation or modification timestamps in the web root. Webshells are often detected by recent file timestamps and anomalous POST requests in logs.

Answer

Verifying SSL certificate validity

Answer

Running a full antivirus scan on the server

Answer

Checking for open ports on the server