CHFI Application, Email and Cloud Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Remote code execution (RCE)

  Why it's wrong here

  This is not remote code execution because the request is an HTTP GET that merely attempts to retrieve a file path; there is no command injection in an application-side execution context. Although path traversal might eventually expose a system binary like cmd.exe, simply requesting it does not execute it, and the returned 404 confirms the file was not found. RCE would require evidence that the server invoked attacker-controlled code, such as a shell command parameter or a successfully uploaded and executed script, which is absent here.

• ✓

  Directory traversal

  Why this is correct

  The presence of ../ (dot-dot-slash) sequences is a classic indicator of directory traversal, where an attacker manipulates file paths to escape the web root and access arbitrary files. In this IIS log entry, the request appears to target a system executable such as cmd.exe outside the website's home directory. Even though the response is 404, the attack pattern—traversing upward with ../ and requesting a sensitive Windows binary—clearly identifies a path traversal attempt rather than another vulnerability class.

• ✗

  Cross-site request forgery (CSRF)

  Why it's wrong here

  CSRF forces an authenticated user's browser to send a forged request, relying on the user's session cookie and the server's inability to verify request intent. This IIS log shows a direct GET request from the attacker's address (10.0.0.5) to fetch cmd.exe; there is no logged-in user, no cookie, and no cross-site page that would trigger the request. Thus, there is no evidence of a victim browser being tricked, which is the defining feature of cross-site request forgery.

• ✗

  SQL injection

  Why it's wrong here

  SQL injection would be visible in the URL as SQL syntax—quotes, semicolons, UNION SELECT, OR 1=1—used to manipulate a database query. This log entry contains only file-system path components (../) and the name of a Windows executable, with no query parameters that interact with a backend database. The attack targets the file system, not a database, so categorizing it as SQL injection is incorrect.

Go deeper

Related to this question