CHFI Application, Email and Cloud Forensics Practice Test 7 — 15 Questions

Question 1

In MySQL forensics, which log file is most commonly used to detect unauthorized data exfiltration or changes to database records?

Accepted Answer

Binary log. The binary log is the correct choice because it records all changes to database data and structure (e.g., INSERT, UPDATE, DELETE, CREATE, ALTER) in a binary format that can be replayed for point-in-time recovery. In MySQL forensics, this log is the primary source for detecting unauthorized data exfiltration or modifications, as it captures the exact SQL statements or row changes that altered the database, along with timestamps and server IDs. Unlike other logs, the binary log is specifically designed to track every write operation, making it indispensable for reconstructing malicious activity.

Answer

Slow query log

Answer

General query log

Answer

Error log

Question 2

An investigator needs to parse and analyze a Microsoft Outlook personal folders file (.pst). Which tool is specifically designed for this purpose?

Accepted Answer

Aid4Mail. Aid4Mail is a forensic email analysis tool that can parse Outlook PST files, among other formats, and extract metadata, attachments, and headers.

Answer

FTK Imager

Answer

Wireshark

Answer

Sleuth Kit

Question 3

In cloud forensics, which AWS service provides a centralized log of API calls made by users and services, often used to investigate unauthorized access or configuration changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls for governance, compliance, and operational auditing, making it essential for forensic investigations in AWS.

Answer

AWS CloudWatch

Answer

AWS Config

Answer

AWS VPC Flow Logs

Question 4

A forensic analyst is examining a Docker container that was used to launch a DDoS attack. Which layer of a Docker image is most likely to contain the attacker's malicious scripts?

Accepted Answer

The topmost writable container layer. Docker images consist of read-only layers. The topmost writable layer (container layer) holds changes made at runtime, such as installing tools or scripts. The attack scripts would be in this layer.

Answer

The overlay filesystem layer

Answer

The volume mounted from the host

Answer

The base image layer

Question 5

Which of the following is a primary challenge in cloud forensics due to shared infrastructure?

Accepted Answer

Multi-tenancy and data comingling. Multi-tenancy means multiple customers share the same physical resources. This complicates evidence isolation and can lead to data comingling, making forensic acquisition difficult.

Answer

Slow internet speeds

Answer

Lack of logging capabilities

Answer

Inability to perform network analysis

Question 6

Which tool is specifically designed to extract metadata from email messages, including tracking the route and identifying the originating IP address?

Accepted Answer

EmailTracker. EmailTracker is a tool that analyzes email headers to trace the path and identify the source IP, often used in email forensics.

Answer

Wireshark

Answer

MailXaminer

Answer

Outlook

Question 7

In an email header, an analyst notices the following: 'Received: from mail.attacker.com (192.168.2.100) by mail.victim.com (Postfix) with ESMTP id ABC123 for <user@victim.com>; ...'. The 'From' address appears as 'ceo@victim.com'. Which type of attack is most likely?

Accepted Answer

Email spoofing. The email claims to be from 'ceo@victim.com' but was received from 'mail.attacker.com', indicating the sender forged the From address. This is email spoofing.

Answer

Man-in-the-middle

Answer

Malware attachment

Answer

Phishing

Question 8

Which cloud service's audit logs would an investigator examine to identify who deleted a virtual machine in an Azure subscription?

Accepted Answer

Azure Activity Log. Azure Activity Log (formerly known as Audit Logs or Operational Logs) is the platform-level log that records all control-plane operations for Azure resources, including virtual machine creation, modification, and deletion. When a VM is deleted, the Activity Log captures the caller (user or service principal), the timestamp, the operation name (e.g., 'Microsoft.Compute/virtualMachines/delete'), and the status. An investigator would query the Activity Log to identify who initiated the deletion, making option B correct.

Answer

GCP Audit Logs

Answer

Azure AD Sign-in Logs

Answer

AWS CloudTrail

Question 9

Which TWO of the following are indicators of a webshell on a web server? (Select TWO.)

Accepted Answer

The file contains system commands executed via GET or POST parameters. Webshells often have recent modification times out of sync with other files, and they typically accept command parameters in GET/POST requests. Large file size alone is not definitive, and missing index.html is unrelated.

Answer

A file named 'cmd.php' with a modification date matching other legitimate files

Answer

The server's index.html file is missing

Answer

The file is over 1 MB in size

Question 10

Which THREE of the following are challenges specific to container forensics? (Select THREE.)

Accepted Answer

Containers share the same kernel as the host, limiting isolation for forensic acquisition. Containers are ephemeral (volatile evidence), they share the host kernel (limited isolation), and they rely on layered images that must be analyzed. Standard disk imaging tools may not work; network isolation is not a specific challenge.

Answer

Network isolation prevents packet capture

Answer

Standard forensic imaging tools can be directly applied

Question 11

In email forensics, which TWO of the following headers are most useful for identifying the true origin of an email? (Select TWO.)

Accepted Answer

X-Originating-IP. Received headers show the path and each server's IP, while X-Originating-IP may contain the sender's IP. DKIM verifies integrity but not origin IP. Message-ID is just an identifier.

Answer

Message-ID

Answer

DKIM-Signature

Answer

MIME-Version

Question 12

A security analyst is reviewing Apache access logs and finds the entry: 192.168.1.100 - - [10/Mar/2025:08:12:34 +0000] "GET /search?q=test' OR '1'='1 HTTP/1.1" 200 532. Which attack does this log entry most likely indicate?

Accepted Answer

SQL injection (SQLi). The presence of ' OR '1'='1 in the query string is a classic SQL injection attempt, designed to bypass authentication or extract data.

Answer

Cross-site scripting (XSS)

Answer

Remote file inclusion (RFI)

Answer

Path traversal

Question 13

During an investigation of a suspected data exfiltration, a forensic analyst examines MySQL general query logs and finds a large number of SELECT queries retrieving customer records, followed by DELETE queries. Which of the following is the most likely conclusion?

Accepted Answer

An attacker exfiltrating data and then deleting the records to cover tracks. The combination of bulk SELECT (exfiltration) followed by DELETE (cover tracks) is a classic pattern of data theft.

Answer

An attempted SQL injection attack

Answer

A misconfigured replication process

Answer

Normal database maintenance operations

Question 14

An incident responder is analyzing a compromised web server and finds a file named 'cmd.aspx' in the uploads directory. The file contains ASP.NET code that accepts commands via the 'cmd' parameter and executes them on the server. Which of the following best describes this artifact?

Accepted Answer

A webshell allowing remote command execution. The file 'cmd.aspx' is an ASP.NET webshell that accepts commands via the 'cmd' parameter and executes them server-side. This is a classic indicator of a webshell, which provides remote command execution (RCE) capabilities to an attacker, not a legitimate administrative tool.

Answer

A legitimate administrative tool for server management

Answer

A backdoor installed via a SQL injection vulnerability

Answer

A malware dropper for deploying ransomware

Question 15

During a cloud forensics investigation of an AWS environment, an analyst extracts CloudTrail logs and notices many events with the error code 'AccessDenied' for a specific IAM user attempting to list an S3 bucket. Which of the following is the most appropriate next step?

Accepted Answer

Review the IAM policies attached to the user to determine if the action was authorized. AccessDenied indicates the user lacks permissions; check IAM policies to see if the user should have access or if it's an unauthorized attempt.

Answer

Immediately disable the IAM user account

Answer

Escalate the issue to law enforcement

Answer

Check the S3 bucket's access logs for the same IP address