CHFI Application, Email and Cloud Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cross-site scripting

  Why it's wrong here

  Wrong because the logged payload lacks HTML or JavaScript context; XSS requires injecting executable script that is reflected or rendered in the browser, and the payload contains only path traversal sequences with no script tags, event handlers, or encoded JavaScript. The IIS log shows a request for a directory-like resource rather than a parameter being echoed, and nothing in the request indicates a browser-side script execution vector.

• ✗

  SQL injection

  Why it's wrong here

  Wrong because the log entry contains no SQL metacharacters or keywords such as a single quote, UNION, SELECT, OR 1=1, or a semicolon, which are necessary for SQL injection in the URI or POST body. A path traversal attempt uses ../ sequences in the URL path, not query-string syntax that would reach a database query, and there is no accompanying SQL error or delay signature to suggest an injection attempt against the backend.

• ✓

  Path traversal

  Why this is correct

  Correct because the raw HTTP request includes ../ in the URL path, which is the classic path traversal pattern that, when decoded or normalized by the server, tries to climb above the web root into restricted directories. In IIS, unencoded or URL-encoded traversal sequences such as %2e%2e%5c can expose system files, and even though the server returned 404, the request itself demonstrates a deliberate traversal attempt against the file-system namespace.

• ✗

  Remote code execution

  Why it's wrong here

  Wrong because the HTTP 404 status indicates that the requested file or script was not found, so no server-side executable was invoked and no code ran on the target. Remote code execution would require evidence of a successful exploit against a vulnerable parser or command injection point, but this log only shows a failed request for a directory path with no output, no status code like 200, and no subsequent behavior indicating a shell or command was executed.

Go deeper

Related to this question