CHFI Application, Email and Cloud Forensics Practice Test 7 — 15 Questions

Question 1

A security analyst reviews Apache access logs and finds the following entry: `192.168.1.10 - - [12/Jul/2024:10:15:30 -0400] "GET /search.php?q=1' UNION SELECT username,password FROM users-- HTTP/1.1" 200 5321 "-" "Mozilla/5.0"`. Which attack technique is most likely being attempted?

Accepted Answer

SQL injection. The log entry shows a SQL injection payload (the UNION SELECT statement) in the query parameter. This is a classic SQL injection attempt.

Answer

Remote file inclusion

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Question 2

During an email forensics investigation, an analyst examines headers and sees `Received: from mail.evil.com (192.168.1.100) by mail.victim.com` followed by `DKIM-Signature: v=1; a=rsa-sha256; d=evil.com; s=selector; bh=...; h=...; b=...`. The email claims to be from support@paypal.com. Which finding is the strongest indicator of spoofing?

Accepted Answer

The DKIM signature domain is evil.com, not paypal.com. The DKIM-Signature domain (evil.com) does not match the claimed sender domain (paypal.com). This mismatch indicates the email is likely spoofed.

Answer

The email was received via SMTP

Answer

The email lacks a SPF record in the header

Answer

The email originated from IP 192.168.1.100

Question 3

Which tool is specifically designed to extract and analyze email metadata, including headers, from various email client formats such as PST and OST files?

Accepted Answer

Aid4Mail. Aid4Mail is a commercial forensic tool that can extract emails and metadata from PST, OST, MBOX, and other formats. EmailTracker is primarily for tracking email delivery, not forensic analysis of client files.

Answer

Wireshark

Answer

EmailTracker

Answer

FTK Imager

Question 4

A forensic analyst is investigating a suspected data exfiltration from a MySQL database. Which log source would be MOST useful to identify the exact SQL queries executed, including SELECT statements that retrieved large volumes of data?

Accepted Answer

MySQL general query log. MySQL's general query log records all SQL queries, including SELECT statements. The binary log records changes (INSERT, UPDATE, DELETE) for replication and recovery, not SELECT queries. Audit logs may be enabled but are not as detailed for SELECT queries by default.

Answer

MySQL error log

Answer

MySQL binary log

Answer

MySQL slow query log

Question 5

In an AWS environment, a security analyst detects unusual API calls that created several IAM users with administrative privileges from an unfamiliar IP address. Which AWS service log should be examined first to identify the specific API calls and the IAM user that made them?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made to the AWS environment, including IAM user creation. It provides details like the source IP, user identity, and the specific API action.

Answer

Amazon S3 access logs

Answer

AWS CloudWatch Logs

Answer

AWS Config

Question 6

Which of the following is a unique challenge in cloud forensics compared to traditional digital forensics?

Accepted Answer

Multi-tenancy and data isolation. Multi-tenancy (multiple customers sharing the same physical infrastructure) is a key challenge in cloud forensics because isolating evidence and maintaining data privacy across tenants is difficult.

Answer

Encryption of data at rest

Answer

Lack of network connectivity

Answer

Inability to acquire disk images

Question 7

During a Docker forensics investigation, an analyst needs to identify the commands executed within a deleted container. Which of the following approaches is MOST effective to retrieve this information?

Accepted Answer

Search the host filesystem for the container's log files in /var/lib/docker/containers. Docker stores container logs in JSON files on the host. Even after a container is removed, its logs may remain on the host filesystem under /var/lib/docker/containers until cleaned. Inspecting image layers only shows filesystem changes, not runtime commands.

Answer

Check the Docker daemon logs for container start/stop events

Answer

Use `docker inspect` on the container ID

Answer

Examine the container's image layers using `docker history`

Question 8

An IIS log entry shows: `2024-07-15 14:22:10 10.0.0.5 GET /../../windows/system32/cmd.exe 404 - Mozilla/5.0`. What attack technique does this log entry indicate?

Accepted Answer

Directory traversal. The presence of '../' sequences in the URI path indicates a path traversal attack attempting to access files outside the web root.

Answer

Remote code execution (RCE)

Answer

Cross-site request forgery (CSRF)

Answer

SQL injection

Question 9

In an email header, which field typically contains the IP address of the original sending client?

Accepted Answer

Received. The 'Received' field in an email header is added by each mail transfer agent (MTA) that processes the message, and the first 'Received' header (at the bottom of the header block) typically contains the IP address of the original sending client (the SMTP client that initiated the connection). This field records the 'from' IP and the 'by' host, making it the definitive source for tracing the origin of the email.

Answer

Return-Path

Answer

Message-ID

Answer

DKIM-Signature

Question 10

A forensic investigator finds a suspicious file named `cmd.aspx` in the web root of a compromised IIS server. The file contains code that accepts command input via HTTP GET parameters and executes it on the server. What is the MOST likely classification of this file?

Accepted Answer

Web shell. A file that accepts commands via HTTP and executes them on the server is a web shell. ASPX is a common extension for .NET web shells.

Answer

Trojan horse

Answer

Cross-site scripting (XSS) exploit

Answer

SQL injection payload

Question 11

In a Google Cloud Platform (GCP) environment, a forensic investigator needs to determine who deleted a Cloud Storage bucket and when. Which log type should be queried to obtain this information?

Accepted Answer

Cloud Audit Logs (Admin Activity). GCP Cloud Audit Logs record admin activities like bucket deletion. Cloud Storage logs (access logs) record object-level operations but not bucket deletion by IAM users.

Answer

Cloud Monitoring metrics

Answer

VPC flow logs

Answer

Cloud Storage access logs

Question 12

Which of the following email authentication protocols uses a digital signature to verify the sender's domain and that the email has not been tampered with?

Accepted Answer

DKIM. DKIM (DomainKeys Identified Mail) uses a digital signature to authenticate the email's domain and integrity.

Answer

DMARC

Answer

SPF

Answer

STARTTLS

Question 13

A forensic analyst is examining Azure Activity Logs for signs of privilege escalation. Which TWO of the following activities would be MOST indicative of an attacker attempting to escalate privileges? (Choose two.)

Accepted Answer

Creation of a custom RBAC role with Owner permissions. Creating a custom RBAC role with high permissions (like Owner) and assigning it to a user can grant elevated privileges. Adding a user to a privileged role (like Global Administrator) directly escalates privileges.

Answer

A user updating their own password

Answer

Deleting a resource group

Answer

A user accessing a storage account they own

Question 14

During a forensic analysis of a compromised web server, an investigator identifies the following log entries. Which THREE entries are the strongest indicators of a successful web shell upload? (Choose three.)

Accepted Answer

POST /upload.php HTTP/1.1 200 0. Successful uploads of aspx or php files that contain web shell code (e.g., with cmd parameter) and subsequent access to those files are strong indicators. The 404 for cmd.exe indicates a path traversal attempt, not a web shell.

Answer

GET /../../windows/system32/cmd.exe HTTP/1.1 404 - -

Answer

GET /images/logo.png HTTP/1.1 304 - -

Question 15

An investigator is analyzing email headers and notices the following: The 'Received' headers show a path through multiple servers, the 'DKIM-Signature' domain matches the sender domain, and 'X-Originating-IP' is present. Which TWO pieces of information are MOST useful to trace the original sender's IP address? (Choose two.)

Accepted Answer

The X-Originating-IP header value. The bottommost 'Received' header contains the IP of the first receiving server, which is often the sender's MTA or the client IP. 'X-Originating-IP' is a non-standard header that may contain the original client IP if included by the outbound server.

Answer

The 'Message-ID' header

Answer

The 'From' header email address

Answer

The DKIM-Signature's 'd=' domain