CHFI Application, Email and Cloud Forensics Practice Test 8 — 15 Questions

Question 1

A forensic analyst is examining Docker container logs and finds a container that ran the command 'rm -rf /' and then stopped. The container was based on a custom image. Which of the following is the most effective way to recover deleted files from the container's filesystem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Recover files from the image layers using 'docker history' and 'docker export'. Docker images consist of immutable layers. When files are deleted in a container, whiteout files are placed in the writable layer, but the original data remains in the underlying image layers. To recover the original files, the analyst should access the image layers directly, for example by using 'docker save' to export the image as a tar archive preserving all layers. 'docker history' can reveal layer IDs, but 'docker export' on a container applies whiteouts and will not recover the deleted files. Therefore, none of the provided options correctly describes the recovery method.

Answer

Restore the container from a backup snapshot

Answer

Use data carving tools on the container's writable layer

Answer

Run 'docker commit' to create an image from the container and then extract files

Question 2

A forensic analyst is reviewing Microsoft IIS logs and finds the entry: 192.168.1.50, -, 10/Feb/2025:14:22:10 +0000, GET /scripts/..%c1%af../winnt/system32/cmd.exe, 404. Which attack technique is indicated by the encoded characters in the URI?

Accepted Answer

Path traversal attack using Unicode encoding. The encoded characters %c1%af in the URI represent a Unicode (UTF-8) overlong encoding of the forward slash character (/). This is a classic path traversal attack (also known as directory traversal) designed to bypass input validation filters that block standard '../' sequences. The request attempts to access cmd.exe in the Windows system directory, which is a common post-exploitation target. The 404 response indicates the server rejected or did not find the resource, but the attack technique is clearly path traversal using Unicode encoding.

Answer

Directory listing attempt

Answer

SQL injection (SQLi)

Answer

Cross-site scripting (XSS)

Question 3

Which of the following tools is specifically designed for parsing and analyzing email headers to detect spoofing and trace the origin of an email?

Accepted Answer

EmailTracker. EmailTracker is a tool that analyzes email headers to track the path of an email and detect spoofing.

Answer

Wireshark

Answer

Volatility

Answer

Sleuth Kit

Question 4

In an Azure environment, an investigator needs to review actions performed by a specific user over the past 30 days. Which Azure service provides the necessary audit logs for this purpose?

Accepted Answer

Azure Activity Log. Azure Activity Logs record all control-plane events (create, update, delete) for Azure resources, including user actions.

Answer

Azure Security Center

Answer

Azure Monitor

Answer

Azure AD Audit Logs

Question 5

A forensic analyst is examining a PST file extracted from a suspect's computer. The analyst wants to recover deleted emails that are no longer visible in the Outlook folder hierarchy. Which approach is most effective?

Accepted Answer

Open the PST in Outlook and check the 'Recoverable Items' folder. Deleted items in PST files may still reside in the 'Deleted Items' folder or be recoverable from the Recoverable Items folder (dumpster) before permanent deletion.

Answer

Perform file carving on the PST file using a forensic tool

Answer

Use a hex editor to manually reconstruct deleted emails

Answer

Use a PST viewer to read the file directly

Question 6

Which of the following is a primary challenge in cloud forensics due to the shared responsibility model?

Accepted Answer

Multi-tenancy and data segregation. In cloud forensics, the shared responsibility model means the cloud provider manages the underlying infrastructure, while the customer controls their data and configurations. Multi-tenancy and data segregation become a primary challenge because forensic investigators must isolate evidence from one tenant without accessing or contaminating data from other tenants, which is complicated by shared physical resources and potential co-mingling of data. This requires careful legal and technical planning to ensure chain of custody and privacy compliance.

Answer

Absence of forensic tools

Answer

Inability to perform network analysis

Answer

Lack of logging capabilities

Question 7

During a database forensic investigation, a MSSQL transaction log analysis reveals a series of INSERT statements that added records to a customer table, followed by a TRUNCATE TABLE statement. What does this pattern most likely indicate?

Accepted Answer

An attacker exfiltrating data and then clearing the table to hide evidence. TRUNCATE TABLE removes all rows and is often used by attackers to cover tracks after exfiltration, while INSERT adds data (possibly exfiltrated or planted).

Answer

A database backup and restore operation

Answer

A scheduled data archiving process

Answer

A DBA testing a new schema

Question 8

A forensic analyst is investigating a web application that was defaced. The Apache access logs show the following entries: (1) GET /cgi-bin/test.cgi HTTP/1.1 with status 200, (2) POST /cgi-bin/test.cgi HTTP/1.1 with status 200, (3) GET /index.html HTTP/1.1 with status 200, (4) GET /images/ HTTP/1.1 with status 301. Which TWO log entries are most suspicious and indicate a likely attack vector?

Accepted Answer

POST /cgi-bin/test.cgi. Entries to /cgi-bin/test.cgi with both GET and POST suggest probing and command execution via CGI. The others are normal traffic.

Answer

GET /index.html

Answer

GET /images/

Answer

All entries are equally suspicious

Question 9

An email investigation reveals that a phishing email was sent from a domain that uses DKIM and SPF. The email headers contain: 'DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; bh=...; h=...; b=...' and 'Received-SPF: pass (example.com: domain of sender@example.com designates 203.0.113.5 as permitted sender)'. Which TWO conclusions can be drawn?

Accepted Answer

The email's DKIM signature is valid. SPF pass indicates the sending IP is authorized; DKIM signature validates the email was signed by the domain. Combined, the email is likely not spoofed.

Answer

The email is definitely legitimate and not spoofed

Answer

The email was sent from a compromised account

Answer

The email originated from a different domain

Question 10

A security analyst is investigating a potential data breach in a GCP environment. The analyst reviews the GCP audit logs and finds the following events: (1) A service account was granted the 'roles/storage.objectAdmin' role on a storage bucket containing sensitive data, (2) The service account then listed objects in the bucket, (3) The service account downloaded several objects. Which THREE actions should the analyst take immediately?

Accepted Answer

Analyze the IAM policy change that granted the role to identify the source. Analyzing the IAM policy change is critical to determine the source of the privilege escalation. In GCP, audit logs record the 'SetIamPolicy' call, which includes the identity that granted the role (e.g., a compromised user, a malicious insider, or an automated script). Identifying the source helps contain the breach and prevent further unauthorized actions.

Answer

Contact law enforcement immediately

Answer

Delete the storage bucket to prevent further access

Question 11

A security analyst reviewing Apache access logs finds entries like: 192.168.1.10 - - [12/Jan/2023:15:23:11 +0000] "GET /search?q=1' OR '1'='1 HTTP/1.1" 200 5324. What attack is indicated?

Accepted Answer

SQL injection. The log entry shows a SQL injection attempt via the 'q' parameter with a tautology. The 200 response indicates the request was processed, suggesting possible success.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Command injection

Question 12

During a cloud forensics investigation, an analyst examines AWS CloudTrail logs and finds an event with "userIdentity":{"type":"AssumedRole","arn":"arn:aws:sts::123456789012:assumed-role/AdminRole/i-0abcd1234efgh5678"}. What does the 'i-0abcd1234efgh5678' portion most likely represent?

Accepted Answer

The session name, which is typically the EC2 instance ID. In CloudTrail, when an EC2 instance assumes a role, the session name is often the instance ID. The 'i-' prefix and alphanumeric string indicate an EC2 instance ID.

Answer

The AWS account ID of the role's trusted entity

Answer

The role's unique identifier assigned by IAM

Answer

The unique ID of the IAM user who assumed the role

Question 13

An email header contains the following line: "Received: from mail.evil.com (192.0.2.1) by mail.victim.com with ESMTP; Mon, 20 Mar 2023 10:00:00 -0500". The next Received line shows a different IP. What does this indicate?

Accepted Answer

The email is likely spoofed. Discrepancies in the Received headers, especially IP mismatches, are a classic sign of email spoofing where the origin is forged.

Answer

The email's DKIM signature is invalid

Answer

The email was encrypted in transit

Answer

The email was forwarded from another server

Question 14

In Docker forensics, which of the following commands would you use to inspect the history of an image, including the commands that created each layer?

Accepted Answer

docker history. The `docker history` command displays the history of an image, showing each layer along with the command that created it. This is essential in forensic investigations to trace how an image was built, including any potentially malicious commands embedded in the layers.

Answer

docker image ls

Answer

docker logs

Answer

docker inspect

Question 15

An investigator needs to recover deleted emails from a Microsoft Outlook PST file. Which forensic technique is most appropriate?

Accepted Answer

Perform file carving on the PST file to recover deleted email fragments. Deleted items in PST files are often recoverable until overwritten; carving can recover remnants.

Answer

Use a hex editor to manually reconstruct the PST headers

Answer

Convert the PST to EML and open each file individually

Answer

Mount the PST file and use Outlook's 'Recover Deleted Items' feature