CHFI Application, Email and Cloud Forensics Practice Test 6 — 15 Questions

Question 1

An analyst reviews an Apache access log entry: '192.168.1.10 - - [10/Oct/2023:13:55:36 +0000] "GET /index.php?id=1%27%20OR%20%271%27%3D%271 HTTP/1.1" 200 1234 "-" "Mozilla/5.0"'. Which attack does this log entry most likely indicate?

Accepted Answer

SQL injection (SQLi) attack. The URL-encoded payload contains SQL injection syntax (%27 is a single quote), attempting to inject an OR condition. This is indicative of a SQL injection attempt.

Answer

Cross-site scripting (XSS) attack

Answer

Path traversal attack

Answer

Remote file inclusion (RFI) attack

Question 2

Which email header field is used to verify that an email was sent by the authorized mail server for the domain and has not been tampered with, using cryptographic signatures?

Accepted Answer

DKIM-Signature. DKIM (DomainKeys Identified Mail) uses a digital signature to verify the email's origin and integrity.

Answer

X-Mailer

Answer

Message-ID

Answer

Received-SPF

Question 3

A forensic investigator examining a compromised Linux server finds a base64-encoded string in the Apache access log: 'GET /cgi-bin/test.cgi?cmd=ZWNobyAiPD9waHAgc3lzdGVtKCRfR0VUW2NtZF0pOyA/PiI+...' After decoding, the string contains a PHP webshell. Which of the following is the MOST effective method to confirm the webshell was executed on the server?

Accepted Answer

Check the server's process accounting logs (e.g., auditd, 'lastcomm') for PHP process invocation with the cmd parameter. To confirm execution, the investigator should examine the server's process history or audit logs (e.g., auditd, bash history) to see if the cmd parameter was processed by the PHP interpreter.

Answer

Perform a memory dump of the server and search for the base64 string

Answer

Analyze the MySQL transaction logs for any database queries triggered by the webshell

Answer

Search for the decoded PHP code in the web server's document root

Question 4

During a cloud forensic investigation, an analyst needs to identify who deleted an S3 bucket in an AWS environment. Which AWS service log should the analyst examine to find the API call and the associated IAM user or role?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made to AWS services, including S3 bucket deletion, along with the identity of the caller.

Answer

Amazon S3 server access logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 5

An email forensic analyst receives a suspicious email and wants to verify the originating IP address. The analyst extracts the email headers and sees multiple 'Received' fields. Which 'Received' header should the analyst consider as the most trustworthy source of the sender's IP?

Accepted Answer

The last 'Received' header at the bottom. The lowest (last) 'Received' header in the email is the first hop from the sender's MTA, making it the most trustworthy for the originating IP.

Answer

The first 'Received' header at the top

Answer

The 'X-Originating-IP' header

Answer

The 'Return-Path' header

Question 6

Which tool is specifically designed to extract and analyze metadata from email messages, including headers, attachments, and embedded objects, for forensic investigations?

Accepted Answer

EmailTracker. EmailTracker is a tool that parses email headers and extracts metadata for forensic analysis, such as tracking the path of an email.

Answer

FTK Imager

Answer

Wireshark

Answer

Sleuth Kit

Question 7

A forensic examiner is investigating a Docker container suspected of being used for malicious activity. Which of the following is the BEST approach to collect volatile evidence from the container without altering its state?

Accepted Answer

Use 'docker commit' to create an image of the container's current state. Using 'docker commit' creates a snapshot of the container's filesystem without stopping the container, preserving volatile evidence.

Answer

Stop the container immediately and then export its filesystem with 'docker export'

Answer

Create a memory dump of the host machine and extract container memory

Answer

Execute 'docker exec' to access the container shell and run forensic tools

Question 8

During an investigation of a web application breach, an analyst reviews IIS logs and finds numerous entries with status code '200' and URIs containing '?cmd=' followed by encoded strings. The analyst also notices that some requests have a 'User-Agent' string resembling 'Microsoft-CryptoAPI/10.0'. What is the MOST likely conclusion?

Accepted Answer

A webshell is being used to execute commands on the server. A valid POST request with no cookies and a suspicious User-Agent could indicate a webshell attempting to exfiltrate data or execute commands, as the User-Agent is atypical for a browser.

Answer

The logs indicate a successful SQL injection attack

Answer

The logs show a cross-site scripting (XSS) attack targeting administrators

Answer

The server is infected with ransomware, encrypting files

Question 9

An investigator needs to analyze a Microsoft Outlook PST file from a suspect's computer. Which of the following tools is specifically designed for parsing and extracting emails, attachments, and metadata from PST files in a forensically sound manner?

Accepted Answer

Aid4Mail. Aid4Mail is a forensic email analysis tool that supports PST file parsing and extraction.

Answer

DBXtract

Answer

MailXaminer

Answer

OutlookSpy

Question 10

In the context of cloud forensics, what is the primary challenge associated with volatile evidence in Infrastructure as a Service (IaaS) environments?

Accepted Answer

Evidence can be lost when the cloud instance is stopped or terminated. Volatile evidence such as memory and running processes disappears when an instance is stopped or terminated, making timely acquisition critical.

Answer

Evidence may be stored across multiple jurisdictions

Answer

Encryption of data at rest prevents access to evidence

Answer

Cloud providers may not allow forensic investigators to access the physical hardware

Question 11

An analyst is investigating a data exfiltration incident. The MySQL transaction logs show a series of unusual SELECT queries retrieving large amounts of data from the 'customers' table, executed by a user account 'webapp'. What should the analyst check NEXT to determine if the data was actually exfiltrated?

Accepted Answer

Review the web server access logs for requests to external IPs containing the queried data. After identifying suspicious queries, the analyst should check the application server logs to see if the results were sent externally.

Answer

Examine the database schema for unauthorized stored procedures

Answer

Analyze the MySQL audit logs for privilege escalation attempts

Answer

Check the MySQL binary logs for any DELETE or DROP statements

Question 12

A forensic investigator is analyzing a compromised web server. In the Apache access logs, the investigator finds the following request: 'GET /images/../../../etc/passwd HTTP/1.1' with a 200 status code. Which of the following is the MOST likely reason the server returned a 200 (OK) response?

Accepted Answer

The server is vulnerable to directory traversal and returned the contents of /etc/passwd. A 200 response to a path traversal request indicates that the server executed the request and returned the file content, meaning the directory traversal attack succeeded.

Answer

The server redirected the request to the root directory and returned the index page

Answer

The server has a custom 404 page that returns a 200 status code

Answer

The request was blocked by a web application firewall (WAF) which returned a 200 status

Question 13

A forensic analyst is examining a Google Cloud Platform (GCP) environment after a security incident. Which TWO GCP services should the analyst use to audit API activity and resource changes? (Select TWO.)

Accepted Answer

Cloud Asset Inventory. Cloud Audit Logs record API calls and resource changes, while Cloud Asset Inventory tracks resource history and configuration changes.

Answer

Cloud Storage Object Change Notification

Answer

Cloud Monitoring

Answer

Cloud Functions

Question 14

In an email forensics investigation, which THREE indicators suggest that an email is likely spoofed? (Select THREE.)

Accepted Answer

The 'DKIM-Signature' header is missing or fails validation. Spoofed emails often fail SPF checks, have no DKIM signature (or a failed one), and may contain mismatched headers like From vs. Return-Path.

Answer

The 'Received-SPF' header shows 'pass'

Answer

The 'From' domain matches the 'Return-Path' domain

Question 15

A security analyst is investigating a potential container escape from a Docker container. Which THREE artifacts should the analyst collect to analyze the incident? (Select THREE.)

Accepted Answer

Host system's audit logs (e.g., /var/log/auth.log). Host audit logs, Docker daemon logs, and container image layers are critical for investigating container escapes.

Answer

Network traffic captures from the host's physical NIC

Answer

Container's memory dump