CHFI Application, Email and Cloud Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  SQL injection

  Why it's wrong here

  The log entries contain no SQL keywords, operators, or quoted strings that would indicate an injection into database queries. Directory traversal attempts use path manipulation such as '../' or encoded backslashes to navigate the filesystem, not to alter SQL logic. SQL injection typically appears in query string parameters like 'id=1 OR 1=1', while these requests target file paths directly.

• ✓

  Directory traversal

  Why this is correct

  The repeated '../' sequences, often encoded as '%2e%2e%5c' or '%2e%2e/', are classic indicators of directory traversal in IIS logs. An attacker sends these sequences to escape the web root and access sensitive files outside it, such as Windows system files or configuration stores. The log entries show a deliberate attempt to navigate the server's directory hierarchy, which is the defining characteristic of a directory traversal attack.

• ✓

  Privilege escalation attempt

  Why this is correct

  This request is a valid privilege escalation attempt because the attacker is trying to access the SAM file (Security Account Manager), which stores Windows password hashes. Successfully retrieving this file through directory traversal could allow offline password cracking and ultimately administrative access. While the technique is directory traversal, the underlying objective is to escalate privileges, so this option correctly describes the attacker's goal.

• ✗

  Denial of service

  Why it's wrong here

  A denial of service attack requires overwhelming the server with a high volume of requests to exhaust resources or cause a crash. The log shows only repeated traversal attempts, not a flood of traffic, and these requests are small, low-bandwidth HTTP GETs. DoS would manifest as thousands of requests per second or patterns like SYN floods, not a few path traversal probes.

• ✗

  Cross-site scripting

  Why it's wrong here

  Cross-site scripting involves injecting executable client-side scripts into web pages that are then rendered to other users, typically via user input reflected or stored in HTML. The IIS log entries show direct file path manipulation with no '<script>' tags, event handlers, or JavaScript payloads in the request. This is a server-side file access attack, not an attack on client-side browser sessions.

Go deeper

Related to this question