CHFI Application, Email and Cloud Forensics Practice Question
A forensic analyst is investigating a compromised Microsoft Exchange Server 2019. The attacker gained access to a mailbox and exfiltrated emails. The analyst needs to determine the exact time and IP address from which the attacker accessed the mailbox via Outlook Web App (OWA). Which Exchange log should the analyst examine to find this information?
⚠ Common exam trap
A common mix-up: candidates confuse mailbox audit logs with IIS logs; audit logs show actions but not the client IP address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IIS logs on the Exchange server
IIS logs on the Exchange server capture HTTP requests to OWA, including the client IP address, timestamp, and username. This directly provides the time and IP address of the attacker's mailbox access. Other logs either lack IP address information or do not focus on OWA access. Therefore, IIS logs are the correct source.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Message tracking logs
Why it's wrong here
Message tracking logs record the flow of email messages through the Exchange organization, including senders, recipients, and message subjects. They do not capture mailbox access events such as OWA logins or the IP address of the client. Therefore, they cannot provide the time and IP address of the attacker's mailbox access.
- ✓
IIS logs on the Exchange server
Why this is correct
OWA is hosted in IIS, and IIS logs record HTTP requests to OWA virtual directories, including the client IP address, timestamp, username, and requested URL. By analyzing IIS logs, the analyst can identify successful logins and mailbox access, including the source IP and time. This makes IIS logs the correct source for this scenario.
- ✗
Exchange audit logs
Why it's wrong here
Exchange audit logs, enabled via mailbox audit logging, record actions performed by mailbox owners and delegates, such as sending, deleting, or accessing items. While they can show mailbox access, they typically do not include the client IP address or the exact OWA session details. Thus, they are insufficient to determine the IP address.
- ✗
Windows Security event logs
Why it's wrong here
Windows Security event logs record authentication events such as successful logons (Event ID 4624) and logoffs. While they may show a logon from an IP address, they do not specifically indicate OWA mailbox access or the mailbox being accessed. They also lack the granularity of IIS logs for OWA-specific activity.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.