CHFI Application, Email and Cloud Forensics Practice Test 5 — 15 Questions

Question 1

Which tool is commonly used to analyze email headers and trace the path of an email across servers by parsing 'Received' fields?

Accepted Answer

EmailTrackerPro. EmailTrackerPro is specifically designed to analyze email headers and trace the path of an email.

Answer

Wireshark

Answer

Volatility

Answer

FTK Imager

Question 2

In an Azure environment, a forensic analyst needs to identify which user assigned a specific role to another user, leading to privilege escalation. Which Azure log should the analyst examine?

Accepted Answer

Azure Activity Log. Azure Activity Log (now part of Azure Monitor) records all control-plane operations, including role assignments and privilege escalations. When a user assigns a role to another user, that action is logged as a 'Microsoft.Authorization/roleAssignments/write' event in the Activity Log, which captures the caller's identity (UPN or Object ID), the target user, and the role assigned. This makes it the definitive source for identifying who performed the role assignment.

Answer

Azure AD Sign-In Logs

Answer

Azure Diagnostic Logs

Answer

Azure Network Watcher Logs

Question 3

An analyst discovers a suspicious file named 'cmd.aspx' in the web root of an IIS server. The file contains ASPX code that executes system commands. The IIS logs show a POST request to '/cmd.aspx' with a 200 status code. Which type of attack is indicated?

Accepted Answer

Webshell upload. The presence of a file named 'cmd.aspx' in the IIS web root that executes system commands, combined with a POST request returning a 200 status code, indicates a webshell upload attack. An attacker has uploaded an ASPX file that acts as a backdoor, allowing remote command execution via HTTP POST requests, which is a classic webshell scenario.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Question 4

Which of the following is a primary challenge in cloud forensics due to the shared responsibility model?

Accepted Answer

Inability to perform live acquisition of volatile data without cooperation from the cloud provider. The shared responsibility model means the cloud provider controls the infrastructure, limiting the investigator's ability to acquire volatile data without provider support.

Answer

Data is always stored in a single jurisdiction

Answer

Lack of encryption support

Answer

Cloud logs are immutable and cannot be altered

Question 5

Which TWO of the following are valid indicators of email spoofing when analyzing email headers?

Accepted Answer

The 'Received-SPF' header shows 'fail'. SPF failure and a mismatch between Reply-To and From are common signs of spoofing.

Answer

The 'From' header domain matches the 'Return-Path' domain

Answer

The 'DKIM-Signature' header validates successfully

Answer

The 'Message-ID' header contains the sender's IP address

Question 6

Which THREE of the following are challenges specific to container forensics?

Accepted Answer

Ephemeral nature of containers: containers are often short-lived and can be deleted quickly. Containers are designed to be ephemeral—they are created, run, and destroyed rapidly, often within minutes or seconds. This short lifespan means that by the time an incident is detected, the container may no longer exist, making traditional live forensics impossible. Forensic investigators must rely on alternative data sources such as container orchestrator logs (e.g., Kubernetes audit logs), image registries, and runtime snapshots captured before deletion.

Answer

Containers cannot be imaged using standard forensic tools

Answer

Container logs are always stored in a centralized location

Question 7

Which TWO of the following are appropriate techniques for identifying a webshell on a compromised web server?

Accepted Answer

Searching for files with recent creation or modification timestamps in the web root. Webshells are often detected by recent file timestamps and anomalous POST requests in logs.

Answer

Verifying SSL certificate validity

Answer

Running a full antivirus scan on the server

Answer

Checking for open ports on the server

Question 8

An analyst reviews an Apache access log entry: '192.168.1.10 - - [10/Oct/2023:13:55:36 +0000] "GET /index.php?id=1%27%20OR%20%271%27%3D%271 HTTP/1.1" 200 1234 "-" "Mozilla/5.0"'. Which attack does this log entry most likely indicate?

Accepted Answer

SQL injection (SQLi) attack. The URL-encoded payload contains SQL injection syntax (%27 is a single quote), attempting to inject an OR condition. This is indicative of a SQL injection attempt.

Answer

Cross-site scripting (XSS) attack

Answer

Path traversal attack

Answer

Remote file inclusion (RFI) attack

Question 9

Which email header field is used to verify that an email was sent by the authorized mail server for the domain and has not been tampered with, using cryptographic signatures?

Accepted Answer

DKIM-Signature. DKIM (DomainKeys Identified Mail) uses a digital signature to verify the email's origin and integrity.

Answer

X-Mailer

Answer

Message-ID

Answer

Received-SPF

Question 10

A forensic investigator examining a compromised Linux server finds a base64-encoded string in the Apache access log: 'GET /cgi-bin/test.cgi?cmd=ZWNobyAiPD9waHAgc3lzdGVtKCRfR0VUW2NtZF0pOyA/PiI+...' After decoding, the string contains a PHP webshell. Which of the following is the MOST effective method to confirm the webshell was executed on the server?

Accepted Answer

Check the server's process accounting logs (e.g., auditd, 'lastcomm') for PHP process invocation with the cmd parameter. Process accounting logs (e.g., auditd, lastcomm) can confirm that the PHP interpreter was executed on the system, which is direct evidence that the web shell script ran. However, the query string parameter (cmd) is passed via the environment variable QUERY_STRING, not as a command-line argument, so it would not normally appear in process accounting logs. The presence of a PHP process associated with the CGI script is sufficient to verify execution.

Answer

Perform a memory dump of the server and search for the base64 string

Answer

Analyze the MySQL transaction logs for any database queries triggered by the webshell

Answer

Search for the decoded PHP code in the web server's document root

Question 11

During a cloud forensic investigation, an analyst needs to identify who deleted an S3 bucket in an AWS environment. Which AWS service log should the analyst examine to find the API call and the associated IAM user or role?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made to AWS services, including S3 bucket deletion, along with the identity of the caller.

Answer

Amazon S3 server access logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 12

Which tool is specifically designed to extract and analyze metadata from email messages, including headers, attachments, and embedded objects, for forensic investigations?

Accepted Answer

EmailTracker. EmailTracker is a tool that parses email headers and extracts metadata for forensic analysis, such as tracking the path of an email.

Answer

FTK Imager

Answer

Wireshark

Answer

Sleuth Kit

Question 13

A forensic examiner is investigating a Docker container suspected of being used for malicious activity. Which of the following is the BEST approach to collect volatile evidence from the container without altering its state?

Accepted Answer

Create a memory dump of the host machine and extract container memory. Creating a memory dump of the host machine and then extracting the container's memory from that dump captures volatile evidence (e.g., running processes, memory contents) without altering the container's state. 'docker commit' only captures the filesystem, not memory. Stopping the container destroys volatile data. 'docker exec' alters the container's state by running commands inside it.

Answer

Stop the container immediately and then export its filesystem with 'docker export'

Answer

Use 'docker commit' to create an image of the container's current state

Answer

Execute 'docker exec' to access the container shell and run forensic tools

Question 14

An investigator needs to analyze a Microsoft Outlook PST file from a suspect's computer. Which of the following tools is specifically designed for parsing and extracting emails, attachments, and metadata from PST files in a forensically sound manner?

Accepted Answer

Aid4Mail. Aid4Mail is a forensic email analysis tool specifically designed to parse and extract emails, attachments, and metadata from PST files in a forensically sound manner. It preserves original metadata (e.g., headers, timestamps, MIME structure) and generates hash-verified exports, making it suitable for legal proceedings. Unlike generic email viewers, Aid4Mail maintains chain of custody and supports forensic imaging of PST containers.

Answer

DBXtract

Answer

MailXaminer

Answer

OutlookSpy

Question 15

In the context of cloud forensics, what is the primary challenge associated with volatile evidence in Infrastructure as a Service (IaaS) environments?

Accepted Answer

Evidence can be lost when the cloud instance is stopped or terminated. Volatile evidence such as memory and running processes disappears when an instance is stopped or terminated, making timely acquisition critical.

Answer

Evidence may be stored across multiple jurisdictions

Answer

Encryption of data at rest prevents access to evidence

Answer

Cloud providers may not allow forensic investigators to access the physical hardware