CHFI Application, Email and Cloud Forensics Practice Test 8 — 15 Questions

Question 1

An email forensic analyst receives a suspicious email and wants to verify the originating IP address. The analyst extracts the email headers and sees multiple 'Received' fields. Which 'Received' header should the analyst consider as the most trustworthy source of the sender's IP?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The last 'Received' header at the bottom. The last 'Received' header at the bottom is the most trustworthy because email headers are added in reverse chronological order: each mail server prepends its own 'Received' field to the top of the header block. Therefore, the bottommost 'Received' header represents the first hop from the sender's MTA (Mail Transfer Agent) or the originating client, making it the closest to the true source IP.

Answer

The first 'Received' header at the top

Answer

The 'X-Originating-IP' header

Answer

The 'Return-Path' header

Question 2

During an investigation of a web application breach, an analyst reviews IIS logs and finds numerous entries with status code '200' and URIs containing '?cmd=' followed by encoded strings. The analyst also notices that some requests have a 'User-Agent' string resembling 'Microsoft-CryptoAPI/10.0'. What is the MOST likely conclusion?

Accepted Answer

A webshell is being used to execute commands on the server. The presence of numerous HTTP 200 (success) responses with URIs containing '?cmd=' followed by encoded strings indicates that an attacker is sending command execution requests to a webshell on the server. The unusual User-Agent string 'Microsoft-CryptoAPI/10.0' is a known evasion technique used by webshell tools (e.g., China Chopper variants) to blend in with legitimate Windows update traffic. Successful command execution returns a 200 status, confirming the webshell is active and under attacker control.

Answer

The logs indicate a successful SQL injection attack

Answer

The logs show a cross-site scripting (XSS) attack targeting administrators

Answer

The server is infected with ransomware, encrypting files

Question 3

In the context of cloud forensics, what is the primary challenge associated with volatile evidence in Infrastructure as a Service (IaaS) environments?

Accepted Answer

Evidence can be lost when the cloud instance is stopped or terminated. Volatile evidence such as memory and running processes disappears when an instance is stopped or terminated, making timely acquisition critical.

Answer

Evidence may be stored across multiple jurisdictions

Answer

Encryption of data at rest prevents access to evidence

Answer

Cloud providers may not allow forensic investigators to access the physical hardware

Question 4

A forensic investigator is analyzing a compromised web server. In the Apache access logs, the investigator finds the following request: 'GET /images/../../../etc/passwd HTTP/1.1' with a 200 status code. Which of the following is the MOST likely reason the server returned a 200 (OK) response?

Accepted Answer

The server is vulnerable to directory traversal and returned the contents of /etc/passwd. A 200 response to a path traversal request indicates that the server executed the request and returned the file content, meaning the directory traversal attack succeeded.

Answer

The server redirected the request to the root directory and returned the index page

Answer

The server has a custom 404 page that returns a 200 status code

Answer

The request was blocked by a web application firewall (WAF) which returned a 200 status

Question 5

A forensic analyst is examining a Google Cloud Platform (GCP) environment after a security incident. Which TWO GCP services should the analyst use to audit API activity and resource changes? (Select TWO.)

Accepted Answer

Cloud Asset Inventory. Cloud Audit Logs record API calls and resource changes, while Cloud Asset Inventory tracks resource history and configuration changes.

Answer

Cloud Storage Object Change Notification

Answer

Cloud Monitoring

Answer

Cloud Functions

Question 6

A security analyst reviews Apache access logs and finds the following entry: `192.168.1.10 - - [12/Jul/2024:10:15:30 -0400] "GET /search.php?q=1' UNION SELECT username,password FROM users-- HTTP/1.1" 200 5321 "-" "Mozilla/5.0"`. Which attack technique is most likely being attempted?

Accepted Answer

SQL injection. The log entry shows a GET request to `/search.php?q=1' UNION SELECT username,password FROM users--`. The single quote (`'`) breaks out of the SQL string context, and the `UNION SELECT` clause attempts to retrieve data from the `users` table. This is a classic SQL injection (SQLi) attack targeting the backend database, as the injected SQL syntax is designed to manipulate the query executed by the application.

Answer

Remote file inclusion

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Question 7

During an email forensics investigation, an analyst examines headers and sees `Received: from mail.evil.com (192.168.1.100) by mail.victim.com` followed by `DKIM-Signature: v=1; a=rsa-sha256; d=evil.com; s=selector; bh=...; h=...; b=...`. The email claims to be from support@paypal.com. Which finding is the strongest indicator of spoofing?

Accepted Answer

The DKIM signature domain is evil.com, not paypal.com. The DKIM signature domain (d=evil.com) does not match the claimed sender domain (paypal.com). DKIM uses a digital signature verified against the public key published in the DNS of the signing domain. Since the signature is from evil.com, the email cannot be authenticated as originating from paypal.com, making this the strongest indicator of spoofing.

Answer

The email was received via SMTP

Answer

The email lacks a SPF record in the header

Answer

The email originated from IP 192.168.1.100

Question 8

Which tool is specifically designed to extract and analyze email metadata, including headers, from various email client formats such as PST and OST files?

Accepted Answer

Aid4Mail. Aid4Mail is a commercial forensic tool that can extract emails and metadata from PST, OST, MBOX, and other formats. EmailTracker is primarily for tracking email delivery, not forensic analysis of client files.

Answer

Wireshark

Answer

EmailTracker

Answer

FTK Imager

Question 9

A forensic analyst is investigating a suspected data exfiltration from a MySQL database. Which log source would be MOST useful to identify the exact SQL queries executed, including SELECT statements that retrieved large volumes of data?

Accepted Answer

MySQL general query log. The MySQL general query log records every SQL statement received from clients, including SELECT queries, making it the most useful source for identifying exact queries executed during a suspected data exfiltration. Unlike other logs, it captures all activity without filtering by error, execution time, or data-change events, so it will show the specific SELECT statements that retrieved large volumes of data.

Answer

MySQL error log

Answer

MySQL binary log

Answer

MySQL slow query log

Question 10

In an AWS environment, a security analyst detects unusual API calls that created several IAM users with administrative privileges from an unfamiliar IP address. Which AWS service log should be examined first to identify the specific API calls and the IAM user that made them?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including the identity of the caller (IAM user or role), the source IP address, and the specific API actions (e.g., CreateUser, AttachUserPolicy). In this scenario, CloudTrail logs will directly show which IAM user made the unusual API calls from the unfamiliar IP address, enabling the analyst to trace the unauthorized activity.

Answer

Amazon S3 access logs

Answer

AWS CloudWatch Logs

Answer

AWS Config

Question 11

Which of the following is a unique challenge in cloud forensics compared to traditional digital forensics?

Accepted Answer

Multi-tenancy and data isolation. In cloud forensics, multi-tenancy and data isolation present a unique challenge because multiple customers share the same physical infrastructure, and forensic investigators must ensure that data acquisition from one tenant does not inadvertently expose or contaminate another tenant's data. This requires careful coordination with the cloud provider to isolate logical boundaries, often using techniques like snapshot-based acquisition or API-driven evidence collection, which are not typical in traditional single-owner digital forensics.

Answer

Encryption of data at rest

Answer

Lack of network connectivity

Answer

Inability to acquire disk images

Question 12

An IIS log entry shows: `2024-07-15 14:22:10 10.0.0.5 GET /../../windows/system32/cmd.exe 404 - Mozilla/5.0`. What attack technique does this log entry indicate?

Accepted Answer

Directory traversal. The presence of '../' sequences in the URI path indicates a path traversal attack attempting to access files outside the web root.

Answer

Remote code execution (RCE)

Answer

Cross-site request forgery (CSRF)

Answer

SQL injection

Question 13

In an email header, which field typically contains the IP address of the original sending client?

Accepted Answer

Received. The 'Received' field in an email header is added by each mail transfer agent (MTA) that processes the message, and the first 'Received' header (at the bottom of the header block) typically contains the IP address of the original sending client (the SMTP client that initiated the connection). This field records the 'from' IP and the 'by' host, making it the definitive source for tracing the origin of the email.

Answer

Return-Path

Answer

Message-ID

Answer

DKIM-Signature

Question 14

A forensic investigator finds a suspicious file named `cmd.aspx` in the web root of a compromised IIS server. The file contains code that accepts command input via HTTP GET parameters and executes it on the server. What is the MOST likely classification of this file?

Accepted Answer

Web shell. A file that accepts commands via HTTP and executes them on the server is a web shell. ASPX is a common extension for .NET web shells.

Answer

Trojan horse

Answer

Cross-site scripting (XSS) exploit

Answer

SQL injection payload

Question 15

In a Google Cloud Platform (GCP) environment, a forensic investigator needs to determine who deleted a Cloud Storage bucket and when. Which log type should be queried to obtain this information?

Accepted Answer

Cloud Audit Logs (Admin Activity). Cloud Audit Logs (Admin Activity) in GCP record all API calls that modify the configuration or metadata of resources, including the deletion of a Cloud Storage bucket. These logs capture the identity of the principal who performed the action, the timestamp, and the specific operation (e.g., `storage.buckets.delete`), making them the authoritative source for answering who deleted a bucket and when.

Answer

Cloud Monitoring metrics

Answer

VPC flow logs

Answer

Cloud Storage access logs