CHFI Application, Email and Cloud Forensics Practice Test 9 — 15 Questions

Question 1

A forensic analyst is investigating a webshell on an IIS server. The access.log shows: 10.0.0.5, -, 12/Mar/2023:14:22:10 +0000, POST /uploads/cmd.aspx, 200, 0, 1234. Which log entry is most indicative of webshell activity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The file path '/uploads/cmd.aspx' and the 200 status code. A POST request to an ASPX file in an uploads directory returning 200 with a small response size and user-agent is suspicious.

Answer

The use of POST method on an ASPX file

Answer

The small response size of 1234 bytes

Answer

The lack of a user-agent in the log

Question 2

An Azure Activity Log shows a suspicious 'Delete Virtual Machine' operation from an IP address in a foreign country. Which THREE actions should the forensic investigator take immediately to preserve evidence and assess impact?

Accepted Answer

Check if the VM's disks have been copied or exported. Checking if the VM's disks have been copied or exported is a critical forensic step to determine if data exfiltration occurred. In Azure, disks can be copied via snapshot, export to storage account, or direct download using the 'Export' operation on the disk resource. The Activity Log may show a 'Copy Disk' or 'Export Disk' operation, but the investigator must verify if the suspicious 'Delete Virtual Machine' operation was preceded or accompanied by disk duplication, which would indicate data theft before destruction.

Answer

Restore the VM from the latest backup

Answer

Immediately revoke all IAM permissions

Question 3

Which TWO tools are commonly used for email forensic analysis and metadata extraction?

Accepted Answer

Aid4Mail. Aid4Mail is a specialized email forensic tool that can extract emails from various sources (PST, EML, MBOX, Exchange, Office 365) and parse metadata such as headers, timestamps, and routing information. It preserves original message integrity and generates structured reports for legal admissibility, making it a standard choice for email forensic analysis.

Answer

Wireshark

Answer

Volatility

Answer

FTK Imager

Question 4

A GCP audit log shows a project owner granted 'iam.serviceAccountUser' role to a service account from a different project. Which TWO potential security implications should the investigator prioritize?

Accepted Answer

The service account can be used to escalate privileges by attaching it to resources. Granting the 'iam.serviceAccountUser' role to a service account from a different project allows that service account to be attached to Compute Engine instances or other resources. Once attached, the service account can inherit the permissions of the original service account, effectively escalating privileges beyond what the cross-project service account originally had. This is a known privilege escalation vector in GCP IAM.

Answer

The audit logging is now disabled for that service account

Answer

The service account's keys are automatically rotated

Answer

The service account can now impersonate any user in the project

Question 5

Which TWO of the following are common challenges specific to cloud forensics?

Accepted Answer

Multi-tenancy issues. Multi-tenancy complicates data isolation, and data jurisdiction affects legal access to data across regions.

Answer

Inability to create disk images

Answer

Permanent data deletion recovery

Answer

Lack of forensic tools

Question 6

A security analyst is reviewing Apache access logs and finds repeated requests to /index.php?id=1' OR '1'='1. Which type of attack is MOST likely being attempted?

Accepted Answer

SQL injection. The pattern 1' OR '1'='1 is a classic SQL injection payload attempting to bypass authentication or extract data. The single quote and OR condition are characteristic of SQLi.

Answer

Remote file inclusion

Answer

Path traversal

Answer

Cross-site scripting (XSS)

Question 7

During a forensic investigation of a compromised web server, an analyst finds the following entry in the IIS access log: 192.168.1.5, -, 04/May/2024:14:23:11, GET /scripts/..%5c../windows/system32/cmd.exe, 200. What is the probable attack vector?

Accepted Answer

Path traversal. The log shows a path traversal attempt using URL-encoded backslashes (%5c) to navigate to cmd.exe. The 200 status indicates the request succeeded. This is a classic path traversal attack.

Answer

Brute force attack

Answer

Cross-site scripting

Answer

SQL injection

Question 8

An email forensic investigator examines a suspicious email and notices the following header: Received: from mail.evil.com (192.168.1.100) by mail.company.com. The DKIM-Signature header fails verification. What does this indicate?

Accepted Answer

The email may be spoofed or its content altered. A failing DKIM-Signature indicates the email may have been tampered with during transit or was not signed by the claimed domain. This is a strong indicator of email spoofing or alteration.

Answer

The receiving server rejected the email

Answer

The email is legitimate and was forwarded through a relay

Answer

The email was sent from a compromised mail server

Question 9

Which TWO of the following are common challenges in cloud forensics that are not typically encountered in traditional on-premises forensics?

Accepted Answer

Multi-tenancy and co-mingling of data. Multi-tenancy and data jurisdiction are unique to cloud environments. Volatile evidence is a general challenge but not exclusive to cloud. Lack of tools is not a typical challenge. Legal warrants apply to both.

Answer

Difficulty in obtaining search warrants

Answer

Lack of forensic tools for cloud environments

Answer

Volatile evidence that may be lost on system shutdown

Question 10

An incident response team is investigating a breach involving a Docker container. Which THREE of the following actions should the team take to preserve forensic evidence?

Accepted Answer

Use docker export to save the container's filesystem as a tar archive. Creating a container image preserves the filesystem and configuration. Saving logs via docker logs captures runtime output. Exporting the container as a tar archive preserves the filesystem. Inspecting while running is not safe for preservation. Deleting removes evidence.

Answer

Stop the container immediately to prevent further compromise

Answer

Use docker inspect to examine container metadata before stopping

Question 11

Which THREE of the following are common challenges specific to cloud forensics? (Select THREE)

Accepted Answer

Data jurisdiction and legal compliance across regions. Cloud forensic investigations must navigate data jurisdiction and legal compliance issues when data is stored across multiple geographic regions, each with its own data protection laws (e.g., GDPR, CLOUD Act). This creates challenges in obtaining lawful access to data that may be physically located in a jurisdiction where the investigator has no legal authority.

Answer

Lack of standardized log formats

Answer

High cost of forensic tools

Question 12

During a database forensic investigation, you need to review Microsoft SQL Server transaction logs to identify unauthorized data modifications. Which of the following SQL Server functions or commands is used to read the transaction log?

Accepted Answer

fn_dblog. The fn_dblog function is the correct choice because it is the undocumented but widely used SQL Server function that reads the transaction log (LDF file) directly, allowing forensic examiners to view every logged operation including data modifications, schema changes, and transaction details. Unlike other DMVs or commands, fn_dblog provides a row-by-row dump of the log records, making it essential for identifying unauthorized changes at the transaction level.

Answer

SELECT * FROM sys.dm_tran_database_transactions

Answer

DBCC LOG

Answer

BACKUP LOG

Question 13

An analyst examines the following Apache access log entry: 192.168.1.10 - - [10/Jan/2023:13:45:22 +0000] "GET /search.php?q=1%27%20UNION%20SELECT%201,2,3-- HTTP/1.1" 200 1234 "-" "Mozilla/5.0". Which attack is MOST likely indicated?

Accepted Answer

SQL Injection. The log shows a UNION SELECT statement in the query parameter, indicating a SQL injection attempt. The URL-encoded single quote (') and comment (--) are classic SQLi payloads.

Answer

Path Traversal

Answer

Cross-Site Scripting (XSS)

Answer

Remote File Inclusion

Question 14

Which of the following email headers is used to verify the domain of the sending server and is commonly used for authentication to prevent spoofing?

Accepted Answer

DKIM-Signature. DKIM-Signature is the correct answer because it is an email authentication method that uses a digital signature to verify the domain of the sending server. It allows the receiver to check that the email was not forged or altered during transit, directly preventing domain spoofing. This header is defined in RFC 6376 and is a core component of email authentication frameworks like DMARC.

Answer

Content-Type

Answer

Received

Answer

X-Mailer

Question 15

A forensic analyst is investigating a Docker container that was used to launch a network attack. The container has been stopped but not removed. Which action should the analyst take FIRST to preserve volatile evidence?

Accepted Answer

Use 'docker commit' to create an image of the container. Preserving the container's file system and logs is key. 'docker commit' creates an image from the container's current state. 'docker export' exports the filesystem as a tar archive. 'docker logs' retrieves logs. 'docker inspect' shows metadata. The container is stopped, so 'docker exec' won't work without starting it, which alters state. 'docker save' saves images, not containers. The best first step is to create an image or export the filesystem.

Answer

Restart the container and use 'docker exec' to collect evidence

Answer

Use 'docker inspect' to view container metadata only

Answer

Use 'docker save' to export the container as a tar file