CHFI Application, Email and Cloud Forensics Practice Test 5 — 15 Questions

Question 1

A forensic analyst is examining a Microsoft Outlook PST file as part of an email investigation. Which tool is specifically designed to parse and analyze PST files and extract email metadata?

Accepted Answer

Aid4Mail. Aid4Mail is a forensic email analysis tool that supports PST, OST, MBOX, and other formats. It is commonly used for email investigations.

Answer

Wireshark

Answer

EmailTracker

Answer

Sleuth Kit

Question 2

In cloud forensics, one of the major challenges is that data may be stored in multiple jurisdictions with different legal requirements. This challenge is known as:

Accepted Answer

Data jurisdiction. Data jurisdiction refers to the legal and regulatory issues that arise when data is stored or processed across different geographic locations with varying laws.

Answer

Multi-tenancy

Answer

Chain of custody

Answer

Volatile evidence

Question 3

Which of the following tools is specifically designed to analyze email headers and track the path of an email, providing information about delays and potential spoofing?

Accepted Answer

EmailTracker. EmailTracker is a tool that analyzes email headers, visualizes the path, and helps identify spoofing and delivery delays.

Answer

Wireshark

Answer

FTK Imager

Answer

Autopsy

Question 4

During a database forensic investigation, you need to review Microsoft SQL Server transaction logs to identify unauthorized data modifications. Which of the following SQL Server functions or commands is used to read the transaction log?

Accepted Answer

fn_dblog. The fn_dblog function is the correct choice because it is the undocumented but widely used SQL Server function that reads the transaction log (LDF file) directly, allowing forensic examiners to view every logged operation including data modifications, schema changes, and transaction details. Unlike other DMVs or commands, fn_dblog provides a row-by-row dump of the log records, making it essential for identifying unauthorized changes at the transaction level.

Answer

SELECT * FROM sys.dm_tran_database_transactions

Answer

DBCC LOG

Answer

BACKUP LOG

Question 5

An analyst is investigating a possible data exfiltration via email. The analyst notices that the email headers contain a DKIM-Signature field that is invalid. Which of the following does a failed DKIM check indicate?

Accepted Answer

The email's content has been modified since it was signed. A failed DKIM check indicates that the email's content has been modified since it was signed by the sending domain's private key. DKIM uses an asymmetric cryptographic signature (typically RSA or ECDSA) to ensure the integrity of specific header fields and the body hash. When the signature verification fails, it means the hash computed from the received message does not match the decrypted hash from the signature, proving tampering or corruption.

Answer

The email was sent through a proxy server

Answer

The email client does not support DKIM

Answer

The email was sent from a different domain than the one in the From field

Question 6

A forensic investigator needs to collect evidence from a Google Cloud Platform (GCP) environment. Which of the following GCP services provides audit logs for administrative activities and data access?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs is the correct answer because it is the dedicated GCP service that captures and stores audit trails for administrative activities (Admin Activity audit logs) and data access (Data Access audit logs) within Google Cloud Platform. These logs record who did what, where, and when, which is essential for forensic investigations in cloud environments.

Answer

Cloud Storage logs

Answer

Cloud Monitoring

Answer

Cloud IAM

Question 7

Which TWO of the following are common indicators of a path traversal attack found in web server logs? (Select 2)

Accepted Answer

Requests containing '../' sequences. Option B is correct because '../' is the canonical directory traversal sequence used to climb out of the web root and reference files outside the intended directory, so its appearance in request paths is a classic path traversal indicator. Option D is correct because '%2e%2e%2f' is the URL-encoded form of '../' (where %2e is '.', and %2f is '/'), and attackers frequently encode traversal sequences to bypass naive filters, making it an equally common log indicator. Option A is not a path traversal indicator; multiple or unusual User-Agent strings relate to client identification, bot activity, or user-agent spoofing, not directory traversal. Option C describes '<script>' tags, which indicate cross-site scripting (XSS) attempts rather than path traversal. Option E describes 'OR 1=1', a SQL injection tautology used to bypass authentication or manipulate queries, not a file-path traversal technique.

Answer

Requests containing a large number of User-Agent strings

Answer

Requests containing '<script>' tags

Answer

Requests containing 'OR 1=1'

Question 8

Which TWO of the following are valid email header fields that can be used to detect email spoofing? (Select 2)

Accepted Answer

Received-SPF. SPF and DKIM are email authentication mechanisms that help detect spoofing. SPF checks if the sending server is authorized, DKIM verifies the email integrity.

Answer

Subject

Answer

Content-Type

Answer

MIME-Version

Question 9

An analyst examines the following Apache access log entry: 192.168.1.10 - - [10/Jan/2023:13:45:22 +0000] "GET /search.php?q=1%27%20UNION%20SELECT%201,2,3-- HTTP/1.1" 200 1234 "-" "Mozilla/5.0". Which attack is MOST likely indicated?

Accepted Answer

SQL Injection. The log shows a UNION SELECT statement in the query parameter, indicating a SQL injection attempt. The URL-encoded single quote (') and comment (--) are classic SQLi payloads.

Answer

Path Traversal

Answer

Cross-Site Scripting (XSS)

Answer

Remote File Inclusion

Question 10

During a forensic investigation of a compromised web server, you find the following entry in the IIS log: 192.168.2.50, -, 10/Jan/2023, 14:32:15, W3SVC1, WEB01, 192.168.2.10, 80, POST, /uploads/shell.aspx, 200, 0, 0, 513, 0, Mozilla/4.0. Which action should the investigator prioritize?

Accepted Answer

Analyze the uploaded shell.aspx file for malicious content. The IIS log entry shows a successful POST (HTTP 200) to /uploads/shell.aspx, which is a classic indicator of a web shell upload. The investigator's priority is to analyze the uploaded file to determine its capabilities, persistence mechanisms, and any data exfiltration or lateral movement it may have enabled. This aligns with forensic best practices: preserve and examine the artifact before taking remediation steps.

Answer

Rebuild the web server from a clean backup

Answer

Delete the shell.aspx file immediately

Answer

Check the web server's firewall logs for the attacker's IP

Question 11

Which tool is specifically designed for parsing and analyzing email headers to trace the origin of an email and detect spoofing?

Accepted Answer

EmailTrackerPro. EmailTrackerPro is specifically designed to parse email headers, extract routing information, and trace the path an email took from sender to recipient. It analyzes fields like Received, Message-ID, and Authentication-Results to detect spoofing, forging, or relay anomalies, making it the correct tool for this task.

Answer

Wireshark

Answer

EnCase

Answer

Nmap

Question 12

A security analyst finds the following entry in the Apache access log: 10.0.0.5 - - [20/Jan/2023:08:12:44 +0000] "GET /../../../../etc/passwd HTTP/1.1" 404 345 "-" "curl/7.68.0". Which attack was attempted?

Accepted Answer

Path Traversal. The URI contains '../../../../etc/passwd', which is a path traversal attempt to read the /etc/passwd file. The 404 status indicates the file was not found, but the intent is clear.

Answer

Remote File Inclusion

Answer

Command Injection

Answer

Cross-Site Request Forgery (CSRF)

Question 13

Which of the following email headers is used to verify the domain of the sending server and is commonly used for authentication to prevent spoofing?

Accepted Answer

DKIM-Signature. DKIM-Signature is the correct answer because it is an email authentication method that uses a digital signature to verify the domain of the sending server. It allows the receiver to check that the email was not forged or altered during transit, directly preventing domain spoofing. This header is defined in RFC 6376 and is a core component of email authentication frameworks like DMARC.

Answer

Content-Type

Answer

Received

Answer

X-Mailer

Question 14

In cloud forensics, which AWS service logs API calls for governance, compliance, and operational auditing, and is the primary source for detecting unauthorized access?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct answer because it is the dedicated AWS service that records all API calls made to the AWS environment, capturing details such as the identity of the caller, the time of the call, the source IP address, and the request parameters. This log data is essential for governance, compliance, and operational auditing, and it serves as the primary forensic source for detecting unauthorized access or suspicious activities by providing an immutable record of who did what and when.

Answer

AWS Config

Answer

Amazon CloudWatch

Answer

AWS GuardDuty

Question 15

In email forensics, which artifact is stored in Outlook's Personal Folders (.pst) files and can be analyzed using tools like Aid4Mail or EmailTracker?

Accepted Answer

Emails, attachments, calendars, contacts, and other mailbox items. Outlook Personal Folders (.pst) files are not limited to storing just email content; they are a comprehensive container for multiple mailbox items. In addition to emails and attachments, .pst files store calendars, contacts, tasks, notes, journal entries, and other mailbox artifacts. Tools like Aid4Mail and EmailTracker can parse the entire .pst structure to extract and analyze all these item types, making option D correct.

Answer

Only the email body text

Answer

Emails and attachments only

Answer

Email headers only