CHFI Application, Email and Cloud Forensics Practice Test 6 — 15 Questions

Question 1

Which TWO of the following are common challenges specific to cloud forensics? (Select TWO)

Accepted Answer

Data jurisdiction and legal compliance. Option C (Data jurisdiction and legal compliance) is correct because cloud data is often stored across multiple geographic regions and controlled by different providers, so forensic investigators must navigate varying laws, privacy regulations (e.g., GDPR), and cross-border data-access rules that complicate evidence collection and chain of custody. Option D (Multi-tenancy and separation of data) is correct because cloud resources are shared among multiple customers on the same physical infrastructure, making it difficult to isolate one tenant's data and artifacts without affecting or exposing others, which is a challenge unique to cloud environments. Options A and B are not specific to cloud forensics: volatile memory acquisition is a general digital-forensics challenge present on any live system, and the inability to image hard drives is generally false since providers and customers can often snapshot or image volumes (though access may be restricted). Option E is also not cloud-specific, as lack of proper tools is a generic limitation across many forensic domains rather than a challenge unique to cloud forensics.

Answer

Volatile memory acquisition

Answer

Inability to image hard drives

Answer

Lack of proper tools

Question 2

Which THREE of the following are indicators of a webshell in web server logs? (Select THREE)

Accepted Answer

POST requests to a script file with large payloads. Webshells are indicated by anomalous script files being accessed, POST requests to script files, and high request rates to a single script. These patterns suggest remote access and command execution.

Answer

Multiple GET requests to /index.html

Answer

Consistent 304 Not Modified responses

Question 3

Which TWO of the following are valid methods to collect logs from Docker containers for forensic analysis? (Select TWO)

Accepted Answer

Using docker logs command to retrieve container logs. Option A is correct because the `docker logs` command retrieves the stdout/stderr output captured by the container's configured logging driver (e.g., json-file, journald), which is the primary source of application logs for forensic review. Option C is correct because `docker cp` allows an investigator to copy log files written inside the container's filesystem (e.g., /var/log/app.log) to the host for offline analysis, which is essential when logs are not sent to stdout/stderr. Option B is not a collection method; `docker inspect` only reveals the logging driver and configuration (such as LogPath), not the log contents themselves. Option D is not a valid collection method because running syslog inside the container starts a new logging service rather than extracting existing container logs. Option E is incorrect because `docker image` inspects image layers and metadata, which contain no runtime container logs.

Answer

Using docker inspect to get log configuration

Answer

Using docker exec to run syslog inside the container

Answer

Using docker image to view the image layers

Question 4

A security analyst reviews an Apache access log and finds the entry: '192.168.1.10 - - [10/Mar/2025:08:12:34 +0000] "GET /index.php?id=1 UNION SELECT username,password FROM users-- HTTP/1.1" 200 2345 "-" "Mozilla/5.0"'. Which attack is indicated?

Accepted Answer

SQL injection. The UNION SELECT statement in the URI indicates a SQL injection attack. The attacker is trying to extract data from the database.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Webshell upload

Question 5

Which email header field is MOST reliable for identifying the true origin of an email, assuming no header tampering occurred at the initial MTA?

Accepted Answer

Received. The 'Received' header is the most reliable for identifying the true origin of an email because each MTA that processes the message adds a new 'Received' header at the top, recording the IP address and timestamp of the previous hop. Assuming no tampering occurred at the initial MTA, the bottommost 'Received' header (the first added) contains the originating IP address of the sender's MTA or client, providing a direct trace back to the source.

Answer

Message-ID

Answer

From

Answer

DKIM-Signature

Question 6

An analyst examining an Outlook PST file wants to recover deleted emails that are no longer visible in the Deleted Items folder. Which technique is MOST effective?

Accepted Answer

Use a forensic tool to carve for deleted items within the PST. Deleted emails in PST files are often not immediately overwritten. Using forensic tools to scan the PST file for unallocated space or deleted items can recover them.

Answer

Convert the PST to an EDB file and mount it

Answer

Repair the PST file using Scanpst.exe

Answer

Reconstruct the PST from the Exchange server backup

Question 7

A web server log shows the following request: 'GET /../../../../etc/passwd HTTP/1.1' with a 200 response code. The web server is running Apache on Linux. What attack has likely succeeded?

Accepted Answer

Local File Inclusion (LFI) or Path Traversal. The request 'GET /../../../../etc/passwd HTTP/1.1' with a 200 response indicates the server successfully returned the contents of the /etc/passwd file. This is a classic path traversal attack (also known as Local File Inclusion) where the attacker uses '../' sequences to escape the web root directory and access arbitrary files on the Linux filesystem. Apache's default configuration does not block such sequences if directory traversal protections are missing, allowing the attacker to read sensitive system files.

Answer

Remote File Inclusion (RFI)

Answer

SQL injection

Answer

Cross-Site Request Forgery (CSRF)

Question 8

Which cloud forensic challenge refers to the inability to physically access the storage media where data resides?

Accepted Answer

Lack of physical access. Cloud forensics often involves data stored on remote servers managed by a cloud service provider (CSP). Forensic investigators cannot physically seize or access the hard drives or SSDs due to the CSP's infrastructure and security policies, making physical access impossible. This lack of physical access is a fundamental challenge that distinguishes cloud forensics from traditional digital forensics, where the media can be physically acquired and imaged.

Answer

Data jurisdiction

Answer

Multi-tenancy

Answer

Volatility of evidence

Question 9

A forensic analyst is investigating a Docker container that was used to launch a network attack. The container has been stopped but not removed. Which action should the analyst take FIRST to preserve volatile evidence?

Accepted Answer

Use 'docker commit' to create an image of the container. Preserving the container's file system and logs is key. 'docker commit' creates an image from the container's current state. 'docker export' exports the filesystem as a tar archive. 'docker logs' retrieves logs. 'docker inspect' shows metadata. The container is stopped, so 'docker exec' won't work without starting it, which alters state. 'docker save' saves images, not containers. The best first step is to create an image or export the filesystem.

Answer

Restart the container and use 'docker exec' to collect evidence

Answer

Use 'docker inspect' to view container metadata only

Answer

Use 'docker save' to export the container as a tar file

Question 10

Which tool is specifically designed to analyze email headers and track the path of an email across multiple servers?

Accepted Answer

EmailTracker. EmailTracker is a web-based tool that parses email headers and visualizes the route. Aid4Mail is for forensic acquisition/analysis. Wireshark captures network packets. FTK Imager is for disk imaging.

Answer

Aid4Mail

Answer

Wireshark

Answer

FTK Imager

Question 11

A forensic analyst is investigating a MySQL database server breach. Which log is MOST useful for identifying a series of queries that exfiltrated data, assuming the attacker used a compromised application account?

Accepted Answer

General query log. MySQL general query log logs all queries, but can be resource-intensive. Binary logs record changes. Error logs contain errors. Slow query log logs slow queries. The general query log is best for seeing all queries from a compromised account.

Answer

Binary log

Answer

Slow query log

Answer

Error log

Question 12

An analyst discovers a suspicious file named 'cmd.aspx' in the uploads directory of an IIS web server. Analysis reveals the file contains code to execute system commands. What is this file most likely?

Accepted Answer

A web shell. A web shell is a malicious script uploaded to a web server (like IIS) that allows an attacker to execute arbitrary system commands through the web interface. The file 'cmd.aspx' is an ASP.NET page, and its ability to execute system commands is the hallmark of a web shell, often used for post-exploitation persistence and remote access.

Answer

A log file

Answer

A benign configuration file

Answer

A backup of a legitimate page

Question 13

Which Azure log source should an investigator query to identify who deleted a virtual machine and when?

Accepted Answer

Azure Activity Log. The Azure Activity Log (formerly known as Audit Logs) is the subscription-level log that records all control-plane operations on Azure resources, including virtual machine creation, deletion, and modification. When a VM is deleted, the Activity Log captures the operation name (e.g., 'Microsoft.Compute/virtualMachines/delete'), the caller's identity (user or service principal), the timestamp, and the status of the operation. This makes it the authoritative source for answering 'who deleted a VM and when'.

Answer

Azure Active Directory sign-in logs

Answer

Azure Diagnostic Settings for the VM

Answer

Network Security Group flow logs

Question 14

A security analyst is investigating a phishing email and notices the DKIM-Signature header is present but fails validation. Which TWO actions should the analyst take?

Accepted Answer

Check the DKIM DNS record for the signing domain. DKIM failure indicates the email may be forged or tampered with. Checking the domain's DKIM DNS record and examining the email headers for other spoofing indicators are appropriate steps.

Answer

Ignore the DKIM failure as it is not important

Answer

Reply to the sender to verify authenticity

Answer

Delete the email immediately

Question 15

A cloud forensic investigator is analyzing a GCP audit log entry for a Compute Engine instance. Which THREE fields are essential for identifying the user and operation performed?

Accepted Answer

methodName. GCP audit logs include the principal email (authenticationInfo), operation type (methodName), and resource name (resourceName). IP address and user agent may be in requestMetadata but not always in every log entry.

Answer

requestMetadata.callerIp

Answer

requestMetadata.userAgent