CHFI Application, Email and Cloud Forensics Practice Test 7 — 15 Questions

Question 1

A forensic analyst is examining a Docker container image for malware. Which TWO techniques can help analyze the image layers?

Accepted Answer

Use 'docker history' to view the build history of the image. Option A is correct because 'docker history' displays the image's build history, showing each layer's creation command (from the Dockerfile instructions), sizes, and IDs, which lets a forensic analyst trace what was executed or added during the build and spot suspicious layers. Option D is correct because 'docker save' exports the full image (all layers plus metadata) as a tar archive, which can be extracted to inspect each layer's filesystem contents directly, including deleted or hidden files, without running the container. Option B is not suitable because 'docker images' only lists image names, tags, sizes, and IDs on the host; it provides no layer-level detail. Option C is not the best fit because 'docker inspect' returns image metadata (config, environment, entrypoint, layer digests) but not the actual layer contents or build commands needed for deep layer analysis. Option E is incorrect because 'docker export' flattens a running container's filesystem into a single tar, losing the layer history and structure, and it targets containers rather than images.

Answer

Use 'docker images' to list all images

Answer

Use 'docker inspect' to view the image metadata

Answer

Use 'docker export' on a running container

Question 2

During a forensic investigation of a compromised web server, an analyst examines the Apache access log and finds the following entry: '192.168.1.10 - - [12/Oct/2024:13:45:22 +0000] "GET /index.php?id=1 UNION SELECT username, password FROM users-- HTTP/1.1" 200 1234 "-" "Mozilla/5.0"'. What type of attack is MOST likely indicated?

Accepted Answer

SQL injection (SQLi). The log entry shows a UNION-based SQL injection attempt, where the attacker appends 'UNION SELECT username, password FROM users--' to the 'id' parameter in the GET request. This manipulates the original SQL query to return sensitive data from the 'users' table, which is the hallmark of SQL injection (SQLi). The HTTP 200 response indicates the query executed successfully, confirming the attack vector.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Remote file inclusion (RFI)

Question 3

An email forensic analyst receives a suspicious email and examines the full headers. Which header field is the MOST reliable for determining the true originating IP address of the sender, assuming no spoofing of the header?

Accepted Answer

Received. The 'Received' header is the most reliable for determining the true originating IP address because each mail server that handles the email adds a new 'Received' field at the top of the header. The bottommost 'Received' header (the first one added) typically contains the IP address of the sender's MTA or the client's IP, assuming no spoofing. This field is sequentially added by each hop and is the primary source for tracing the email's path back to its origin.

Answer

Return-Path

Answer

Message-ID

Answer

From

Question 4

A cloud forensic investigator is examining AWS CloudTrail logs for signs of unauthorized access to an S3 bucket. Which of the following CloudTrail event names would indicate a successful attempt to list the objects in the bucket?

Accepted Answer

ListObjects. The ListObjects operation lists the objects in an S3 bucket; the CloudTrail event name is 'ListObjects'.

Answer

GetObject

Answer

PutObject

Answer

DeleteObject

Question 5

An investigator is analyzing a compromised MySQL database server. To determine the exact time and content of a suspect data exfiltration query, which MySQL log should be examined first, assuming it is enabled?

Accepted Answer

General query log. The general query log records every SQL statement received by the MySQL server, including SELECT queries used for data exfiltration. Since the investigator needs the exact time and content of the suspect query, this log provides a complete, chronological record of all client-sent statements, making it the primary source for identifying the exfiltration event.

Answer

Error log

Answer

Binary log

Answer

Slow query log

Question 6

During a forensic investigation of a Google Cloud Platform (GCP) environment, an analyst reviews Audit Logs and sees a log entry with the method 'storage.objects.list' and a principal email 'attacker@gmail.com'. However, the identity is not from the organization's domain. What should the analyst conclude?

Accepted Answer

An external identity was granted IAM permissions on the bucket, possibly through a misconfigured resource.. In GCP, Audit Logs record the actual identity used to authenticate the API call. The presence of 'attacker@gmail.com' as the principal email indicates that an external Google account (not part of the organization's domain) was granted IAM permissions on the bucket, likely through a misconfigured resource policy (e.g., a bucket-level IAM policy that allows allUsers or a specific external user). This is a common cloud security misconfiguration where overly permissive IAM bindings are applied.

Answer

The analyst must immediately shut down the bucket.

Answer

The attacker spoofed the principal email in the log.

Answer

The log entry is a false positive due to a logging error.

Question 7

Which tool is commonly used to analyze email headers and trace the path of an email across servers by parsing 'Received' fields?

Accepted Answer

EmailTrackerPro. EmailTrackerPro is specifically designed to analyze email headers and trace the path of an email.

Answer

Wireshark

Answer

Volatility

Answer

FTK Imager

Question 8

In an Azure environment, a forensic analyst needs to identify which user assigned a specific role to another user, leading to privilege escalation. Which Azure log should the analyst examine?

Accepted Answer

Azure Activity Log. Azure Activity Log (now part of Azure Monitor) records all control-plane operations, including role assignments and privilege escalations. When a user assigns a role to another user, that action is logged as a 'Microsoft.Authorization/roleAssignments/write' event in the Activity Log, which captures the caller's identity (UPN or Object ID), the target user, and the role assigned. This makes it the definitive source for identifying who performed the role assignment.

Answer

Azure AD Sign-In Logs

Answer

Azure Diagnostic Logs

Answer

Azure Network Watcher Logs

Question 9

An analyst discovers a suspicious file named 'cmd.aspx' in the web root of an IIS server. The file contains ASPX code that executes system commands. The IIS logs show a POST request to '/cmd.aspx' with a 200 status code. Which type of attack is indicated?

Accepted Answer

Webshell upload. The presence of a file named 'cmd.aspx' in the IIS web root that executes system commands, combined with a POST request returning a 200 status code, indicates a webshell upload attack. An attacker has uploaded an ASPX file that acts as a backdoor, allowing remote command execution via HTTP POST requests, which is a classic webshell scenario.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Question 10

Which of the following is a primary challenge in cloud forensics due to the shared responsibility model?

Accepted Answer

Inability to perform live acquisition of volatile data without cooperation from the cloud provider. The shared responsibility model means the cloud provider controls the infrastructure, limiting the investigator's ability to acquire volatile data without provider support.

Answer

Data is always stored in a single jurisdiction

Answer

Lack of encryption support

Answer

Cloud logs are immutable and cannot be altered

Question 11

Which THREE of the following are challenges specific to container forensics?

Accepted Answer

Ephemeral nature of containers: containers are often short-lived and can be deleted quickly. Option A is correct because containers are frequently ephemeral—they can be stopped, deleted, or replaced in seconds—so volatile evidence such as running processes, memory, and writable layer data may disappear before acquisition, making timely capture critical. Option D is correct because a container image is built from stacked layers (e.g., in OCI/Docker format), and each layer may contain distinct artifacts, deleted files, or modifications, so investigators must analyze every layer rather than just the final filesystem view. Option E is correct because containers share the host's kernel via namespaces and cgroups rather than running their own kernel, so kernel-level artifacts (e.g., kernel modules, some syscalls, and host-level kernel logs) are not isolated within the container and must be examined on the host instead. Option B is not correct because containers and their images can be imaged or exported using standard tools such as docker export, docker save, or dd on the underlying storage, so this is not an inherent limitation. Option C is not correct because container logs are not always centralized; by default they are stored locally on the host (e.g., under /var/lib/docker/containers or via the configured logging driver), and centralization only occurs if a logging driver or aggregation system is explicitly configured.

Answer

Containers cannot be imaged using standard forensic tools

Answer

Container logs are always stored in a centralized location

Question 12

Which TWO of the following are appropriate techniques for identifying a webshell on a compromised web server?

Accepted Answer

Searching for files with recent creation or modification timestamps in the web root. Webshells are often detected by recent file timestamps and anomalous POST requests in logs.

Answer

Verifying SSL certificate validity

Answer

Running a full antivirus scan on the server

Answer

Checking for open ports on the server

Question 13

An analyst reviews an Apache access log entry: '192.168.1.10 - - [10/Oct/2023:13:55:36 +0000] "GET /index.php?id=1%27%20OR%20%271%27%3D%271 HTTP/1.1" 200 1234 "-" "Mozilla/5.0"'. Which attack does this log entry most likely indicate?

Accepted Answer

SQL injection (SQLi) attack. The URL-encoded payload contains SQL injection syntax (%27 is a single quote), attempting to inject an OR condition. This is indicative of a SQL injection attempt.

Answer

Cross-site scripting (XSS) attack

Answer

Path traversal attack

Answer

Remote file inclusion (RFI) attack

Question 14

Which email header field is used to verify that an email was sent by the authorized mail server for the domain and has not been tampered with, using cryptographic signatures?

Accepted Answer

DKIM-Signature. DKIM (DomainKeys Identified Mail) uses a digital signature to verify the email's origin and integrity.

Answer

X-Mailer

Answer

Message-ID

Answer

Received-SPF

Question 15

During a cloud forensic investigation, an analyst needs to identify who deleted an S3 bucket in an AWS environment. Which AWS service log should the analyst examine to find the API call and the associated IAM user or role?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made to AWS services, including S3 bucket deletion, along with the identity of the caller.

Answer

Amazon S3 server access logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs