CHFI Application, Email and Cloud Forensics Practice Test 9 — 15 Questions

Question 1

A security analyst is reviewing Apache access logs and finds the entry: 192.168.1.100 - - [10/Mar/2025:08:12:34 +0000] "GET /search?q=test' OR '1'='1 HTTP/1.1" 200 532. Which attack does this log entry most likely indicate?

Accepted Answer

SQL injection (SQLi). The presence of ' OR '1'='1 in the query string is a classic SQL injection attempt, designed to bypass authentication or extract data.

Answer

Cross-site scripting (XSS)

Answer

Remote file inclusion (RFI)

Answer

Path traversal

Question 2

During an investigation of a suspected data exfiltration, a forensic analyst examines MySQL general query logs and finds a large number of SELECT queries retrieving customer records, followed by DELETE queries. Which of the following is the most likely conclusion?

Accepted Answer

An attacker exfiltrating data and then deleting the records to cover tracks. The combination of bulk SELECT (exfiltration) followed by DELETE (cover tracks) is a classic pattern of data theft.

Answer

An attempted SQL injection attack

Answer

A misconfigured replication process

Answer

Normal database maintenance operations

Question 3

An incident responder is analyzing a compromised web server and finds a file named 'cmd.aspx' in the uploads directory. The file contains ASP.NET code that accepts commands via the 'cmd' parameter and executes them on the server. Which of the following best describes this artifact?

Accepted Answer

A webshell allowing remote command execution. A web shell is a script uploaded to a web server that allows remote command execution. The filename and behavior match a webshell.

Answer

A legitimate administrative tool for server management

Answer

A backdoor installed via a SQL injection vulnerability

Answer

A malware dropper for deploying ransomware

Question 4

An email forensic analyst receives a suspicious email and wants to trace its origin. Which email header field provides the most reliable information about the IP address of the sending SMTP server?

Accepted Answer

Received. The 'Received' header is added by each SMTP server that handles the email, and the last 'Received' header (or the first after the client) contains the originating IP.

Answer

Return-Path

Answer

DKIM-Signature

Answer

X-Originating-IP

Question 5

During a cloud forensics investigation of an AWS environment, an analyst extracts CloudTrail logs and notices many events with the error code 'AccessDenied' for a specific IAM user attempting to list an S3 bucket. Which of the following is the most appropriate next step?

Accepted Answer

Review the IAM policies attached to the user to determine if the action was authorized. AccessDenied indicates the user lacks permissions; check IAM policies to see if the user should have access or if it's an unauthorized attempt.

Answer

Immediately disable the IAM user account

Answer

Escalate the issue to law enforcement

Answer

Check the S3 bucket's access logs for the same IP address

Question 6

A forensic analyst is examining Docker container logs and finds a container that ran the command 'rm -rf /' and then stopped. The container was based on a custom image. Which of the following is the most effective way to recover deleted files from the container's filesystem?

Accepted Answer

Recover files from the image layers using 'docker history' and 'docker export'. Docker images consist of layers. Even if a container deletes files, the underlying image layers are read-only and contain the original files. Inspecting the image layers can recover them.

Answer

Restore the container from a backup snapshot

Answer

Use data carving tools on the container's writable layer

Answer

Run 'docker commit' to create an image from the container and then extract files

Question 7

A forensic analyst is reviewing Microsoft IIS logs and finds the entry: 192.168.1.50, -, 10/Feb/2025:14:22:10 +0000, GET /scripts/..%c1%af../winnt/system32/cmd.exe, 404. Which attack technique is indicated by the encoded characters in the URI?

Accepted Answer

Path traversal attack using Unicode encoding. The ..%c1%af.. is an encoded path traversal sequence (Unicode encoding) used to bypass filters and access restricted files.

Answer

Directory listing attempt

Answer

SQL injection (SQLi)

Answer

Cross-site scripting (XSS)

Question 8

Which of the following tools is specifically designed for parsing and analyzing email headers to detect spoofing and trace the origin of an email?

Accepted Answer

EmailTracker. EmailTracker is a tool that analyzes email headers to track the path of an email and detect spoofing.

Answer

Wireshark

Answer

Volatility

Answer

Sleuth Kit

Question 9

In an Azure environment, an investigator needs to review actions performed by a specific user over the past 30 days. Which Azure service provides the necessary audit logs for this purpose?

Accepted Answer

Azure Activity Log. Azure Activity Logs record all control-plane events (create, update, delete) for Azure resources, including user actions.

Answer

Azure Security Center

Answer

Azure Monitor

Answer

Azure AD Audit Logs

Question 10

A forensic analyst is examining a PST file extracted from a suspect's computer. The analyst wants to recover deleted emails that are no longer visible in the Outlook folder hierarchy. Which approach is most effective?

Accepted Answer

Open the PST in Outlook and check the 'Recoverable Items' folder. Deleted items in PST files may still reside in the 'Deleted Items' folder or be recoverable from the Recoverable Items folder (dumpster) before permanent deletion.

Answer

Perform file carving on the PST file using a forensic tool

Answer

Use a hex editor to manually reconstruct deleted emails

Answer

Use a PST viewer to read the file directly

Question 11

Which of the following is a primary challenge in cloud forensics due to the shared responsibility model?

Accepted Answer

Multi-tenancy and data segregation. Multi-tenancy means data from multiple customers may reside on the same physical hardware, complicating isolation and acquisition of evidence.

Answer

Absence of forensic tools

Answer

Inability to perform network analysis

Answer

Lack of logging capabilities

Question 12

During a database forensic investigation, a MSSQL transaction log analysis reveals a series of INSERT statements that added records to a customer table, followed by a TRUNCATE TABLE statement. What does this pattern most likely indicate?

Accepted Answer

An attacker exfiltrating data and then clearing the table to hide evidence. TRUNCATE TABLE removes all rows and is often used by attackers to cover tracks after exfiltration, while INSERT adds data (possibly exfiltrated or planted).

Answer

A database backup and restore operation

Answer

A scheduled data archiving process

Answer

A DBA testing a new schema

Question 13

A forensic analyst is investigating a web application that was defaced. The Apache access logs show the following entries: (1) GET /cgi-bin/test.cgi HTTP/1.1 with status 200, (2) POST /cgi-bin/test.cgi HTTP/1.1 with status 200, (3) GET /index.html HTTP/1.1 with status 200, (4) GET /images/ HTTP/1.1 with status 301. Which TWO log entries are most suspicious and indicate a likely attack vector?

Accepted Answer

POST /cgi-bin/test.cgi. Entries to /cgi-bin/test.cgi with both GET and POST suggest probing and command execution via CGI. The others are normal traffic.

Answer

GET /index.html

Answer

GET /images/

Answer

All entries are equally suspicious

Question 14

An email investigation reveals that a phishing email was sent from a domain that uses DKIM and SPF. The email headers contain: 'DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; bh=...; h=...; b=...' and 'Received-SPF: pass (example.com: domain of sender@example.com designates 203.0.113.5 as permitted sender)'. Which TWO conclusions can be drawn?

Accepted Answer

The email's DKIM signature is valid. SPF pass indicates the sending IP is authorized; DKIM signature validates the email was signed by the domain. Combined, the email is likely not spoofed.

Answer

The email is definitely legitimate and not spoofed

Answer

The email was sent from a compromised account

Answer

The email originated from a different domain

Question 15

A security analyst is investigating a potential data breach in a GCP environment. The analyst reviews the GCP audit logs and finds the following events: (1) A service account was granted the 'roles/storage.objectAdmin' role on a storage bucket containing sensitive data, (2) The service account then listed objects in the bucket, (3) The service account downloaded several objects. Which THREE actions should the analyst take immediately?

Accepted Answer

Analyze the IAM policy change that granted the role to identify the source. The analyst should revoke access to prevent further exfiltration, preserve the logs for investigation, and examine the source of the role grant (IAM changes).

Answer

Contact law enforcement immediately

Answer

Delete the storage bucket to prevent further access