CHFI Application, Email and Cloud Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  GetObject

  Why it's wrong here

  GetObject is an S3 data-plane API call that retrieves the actual bytes/content of a specific existing object, and in CloudTrail it appears as eventName 'GetObject' with the bucket name and exact object key. This operation requires the caller to already know or guess the key; it does not return any directory or bucket listing. Therefore, while GetObject proves a read of a known object's contents, it cannot show that the investigator's target bucket was enumerated, making it incorrect for detecting a ListObjects-style access.

• ✗

  PutObject

  Why it's wrong here

  PutObject is a write data-plane call that uploads a new object or overwrites an existing one in the bucket, and CloudTrail logs it as eventName 'PutObject' with the destination key. It is used when data is being placed into S3, which in a forensic context might indicate data exfiltration staging or evidence tampering, but it does not retrieve or enumerate what is already stored in the bucket. Since the question concerns accessing/enumerating bucket contents rather than modifying them, PutObject cannot be the right event.

• ✗

  DeleteObject

  Why it's wrong here

  DeleteObject is a destructive data-plane operation that removes a single object permanently from an S3 bucket (or marks the latest version for deletion in versioned buckets), and appears in CloudTrail as eventName 'DeleteObject' with the target key. It is relevant to investigations where an actor is trying to destroy evidence, but it provides no read access and does not list remaining objects in the bucket. This is why DeleteObject is incorrect for confirming that the bucket's object inventory was accessed.

• ✓

  ListObjects

  Why this is correct

  ListObjects is the S3 API call that returns a list of object keys, sizes, and metadata for a bucket, optionally filtered by a prefix or delimiter, and in CloudTrail it is recorded as eventName 'ListObjects' (or 'ListObjectsV2' for the paginated version). This operation enables an actor to enumerate bucket contents without knowing specific keys in advance, which is exactly what a forensic investigator would look for to establish reconnaissance or unauthorized enumeration. As the correct answer, ListObjects indicates that someone accessed the bucket's inventory, unlike Get, Put, and Delete operations that target a single known object.

Go deeper

Related to this question