Courseiva

CCNA Application, Email and Cloud Forensics Questions

25 questions · Application, Email and Cloud Forensics · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

During an email forensics investigation, an analyst examines headers and sees `Received: from mail.evil.com (192.168.1.100) by mail.victim.com` followed by `DKIM-Signature: v=1; a=rsa-sha256; d=evil.com; s=selector; bh=...; h=...; b=...`. The email claims to be from support@paypal.com. Which finding is the strongest indicator of spoofing?

A.The email was received via SMTP
B.The email lacks a SPF record in the header
C.The email originated from IP 192.168.1.100
D.The DKIM signature domain is evil.com, not paypal.com
AnswerD

A valid DKIM signature verified under the domain 'evil.com' while the From header claims 'paypal.com' is a definitive spoofing indicator. The 'd=' tag in the DKIM signature identifies which domain's private key signed the message, and Paypal's private key is cryptographically inaccessible to an attacker. Under DMARC alignment, the signing domain must match the From domain (or be an organizational parent), so this mismatch proves the message was not authorized by Paypal and is a direct sign of forgery, much stronger than SMTP or SPF observations.

Why this answer

The DKIM signature domain (d=evil.com) does not match the claimed sender domain (paypal.com). DKIM uses a digital signature verified against the public key published in the DNS of the signing domain. Since the signature is from evil.com, the email cannot be authenticated as originating from paypal.com, making this the strongest indicator of spoofing.

Exam trap

EC-Council CHFI often tests the distinction between authentication mechanisms (SPF, DKIM, DMARC) and the specific meaning of DKIM's 'd=' tag, trapping candidates who think any missing authentication header or a private IP alone is the strongest spoofing indicator.

How to eliminate wrong answers

Option A is wrong because SMTP is the standard protocol for email transmission and does not itself indicate spoofing; almost all emails are received via SMTP. Option B is wrong because the absence of an SPF record in the header does not directly prove spoofing—SPF may not be published or checked, and the header shown does not include an SPF result. Option C is wrong because the IP 192.168.1.100 is a private RFC 1918 address, which is non-routable on the public internet; its presence in a Received header often indicates internal relay or header manipulation, but it is not as definitive as the DKIM domain mismatch.

Practice this question →
2
MCQeasy

An analyst finds the following string in an IIS log: %3Cscript%3Ealert('XSS')%3C/script%3E. What does this indicate?

A.A cross-site scripting (XSS) attempt
B.A SQL injection attempt
C.A buffer overflow attempt
D.A path traversal attempt
AnswerA

The string 3cscri is a signature of an XSS attempt because 3c is the hexadecimal encoding of the ASCII character '<', and 'scri' is the beginning of the word 'script'. When decoded, this represents the start of an HTML/JavaScript payload such as <script>, which would execute in a victim's browser. IIS logs often capture URL-encoded or hex-encoded characters, so this observed fragment strongly indicates cross-site scripting rather than any other web attack.

Why this answer

The string is URL-encoded HTML/JavaScript (<script>alert('XSS')</script>). It is a typical cross-site scripting payload attempting to execute in a browser.

Practice this question →
3
MCQmedium

During a forensic investigation of a compromised web server, an analyst examines the Apache access log and finds the following entry: '192.168.1.10 - - [12/Oct/2024:13:45:22 +0000] "GET /index.php?id=1 UNION SELECT username, password FROM users-- HTTP/1.1" 200 1234 "-" "Mozilla/5.0"'. What type of attack is MOST likely indicated?

A.Cross-site scripting (XSS)
B.SQL injection (SQLi)
C.Path traversal
D.Remote file inclusion (RFI)
AnswerB

The GET request to the id parameter with ' UNION SELECT username,password FROM users -- is a textbook UNION-based SQL injection payload. The single quote closes the original SQL string, UNION SELECT appends attacker-controlled columns to the result set, and the '--' comment sequence comments out the remainder of the original WHERE clause so the query executes exactly as the attacker intends. This causes the application's database to return records (e.g., credentials) that should never be exposed, making SQL injection the correct classification.

Why this answer

The log entry shows a UNION-based SQL injection attempt, where the attacker appends 'UNION SELECT username, password FROM users--' to the 'id' parameter in the GET request. This manipulates the original SQL query to return sensitive data from the 'users' table, which is the hallmark of SQL injection (SQLi). The HTTP 200 response indicates the query executed successfully, confirming the attack vector.

Exam trap

The trap here is that candidates may confuse the 'UNION SELECT' syntax with a path traversal or RFI attack because they see a URL parameter with special characters, but the key indicator is the SQL-specific command structure, not file paths or remote URLs.

How to eliminate wrong answers

Option A is wrong because cross-site scripting (XSS) involves injecting client-side scripts (e.g., JavaScript) into web pages viewed by other users, not manipulating SQL queries via URL parameters; the log shows no script tags or event handlers. Option C is wrong because path traversal attacks use '../' sequences to access files outside the web root (e.g., /etc/passwd), not SQL syntax like 'UNION SELECT'. Option D is wrong because remote file inclusion (RFI) involves including a remote file (e.g., via 'http://evil.com/shell.txt') in a server-side include or function, not injecting SQL commands into a database query.

Practice this question →
4
MCQhard

During a forensic investigation of a Google Cloud Platform (GCP) environment, an analyst reviews Audit Logs and sees a log entry with the method 'storage.objects.list' and a principal email 'attacker@gmail.com'. However, the identity is not from the organization's domain. What should the analyst conclude?

A.The analyst must immediately shut down the bucket.
B.The attacker spoofed the principal email in the log.
C.An external identity was granted IAM permissions on the bucket, possibly through a misconfigured resource.
D.The log entry is a false positive due to a logging error.
AnswerC

The presence of an external email address in the principal field of the Cloud Audit Log entry indicates that an IAM policy binding grants permissions to an identity outside the organization. This often happens when a bucket has been made public or when a resource-level IAM policy accidentally includes an external user or allUsers/allAuthenticatedUsers. The analyst should examine the bucket's IAM policy using `gcloud iam policies get` or the Cloud Console to identify the exact binding.

Why this answer

In GCP, Audit Logs record the actual identity used to authenticate the API call. The presence of 'attacker@gmail.com' as the principal email indicates that an external Google account (not part of the organization's domain) was granted IAM permissions on the bucket, likely through a misconfigured resource policy (e.g., a bucket-level IAM policy that allows allUsers or a specific external user). This is a common cloud security misconfiguration where overly permissive IAM bindings are applied.

Exam trap

EC-Council often tests the misconception that Audit Logs can be spoofed or that external identities cannot appear in logs unless there is a logging error, but the correct understanding is that GCP Audit Logs faithfully record the authenticated identity, and an external email indicates a real IAM permission grant.

How to eliminate wrong answers

Option A is wrong because immediately shutting down the bucket is a reactive, non-forensic action that could destroy evidence; the analyst should first verify the scope of the misconfiguration and preserve logs. Option B is wrong because GCP Audit Logs are generated by the Cloud Audit Logs service and the principal email is extracted from the authenticated identity token (OAuth 2.0 or JWT) — spoofing the principal email would require compromising the authentication mechanism, which is not feasible for an external attacker. Option D is wrong because Audit Logs are tamper-proof and generated by the GCP infrastructure; a logging error that introduces a specific external email is extremely unlikely and would be a systemic issue, not a one-off false positive.

Practice this question →
5
Multi-Selectmedium

A security analyst notices repeated entries in an IIS log: 10.0.0.2, -, 05/Feb/2023:08:12:34 +0000, GET /../../windows/system32/config/sam, 404, 0, 532. Which TWO of the following attack types are indicated by this log entry?

Select 2 answers
A.SQL injection
B.Directory traversal
C.Privilege escalation attempt
D.Denial of service
E.Cross-site scripting
AnswersB, C

The repeated '../' sequences, often encoded as '%2e%2e%5c' or '%2e%2e/', are classic indicators of directory traversal in IIS logs. An attacker sends these sequences to escape the web root and access sensitive files outside it, such as Windows system files or configuration stores. The log entries show a deliberate attempt to navigate the server's directory hierarchy, which is the defining characteristic of a directory traversal attack.

Why this answer

The use of '../' indicates path traversal, and the target file (SAM) is a common target for privilege escalation.

Practice this question →
6
Multi-Selectmedium

An investigator is analyzing email headers and notices the following: The 'Received' headers show a path through multiple servers, the 'DKIM-Signature' domain matches the sender domain, and 'X-Originating-IP' is present. Which TWO pieces of information are MOST useful to trace the original sender's IP address? (Choose two.)

Select 2 answers
A.The 'Message-ID' header
B.The 'From' header email address
C.The DKIM-Signature's 'd=' domain
D.The X-Originating-IP header value
E.The last (bottommost) Received header's IP
AnswersD, E

Some mail servers add this header with the original client IP.

Why this answer

The X-Originating-IP header is explicitly added by some mail servers (e.g., Microsoft Exchange) to record the originating IP of the client that submitted the message, making it a direct source for the sender's IP. The last (bottommost) Received header represents the first hop from the sender's mail client or server, as each receiving server prepends its own Received header, so the bottommost one contains the IP of the initial connecting host.

Exam trap

EC-Council CHFI often tests the distinction between headers that contain routing information (Received, X-Originating-IP) and those that contain metadata or authentication data (Message-ID, From, DKIM), leading candidates to mistakenly choose headers that are easily forged or unrelated to IP tracing.

Practice this question →
7
Multi-Selectmedium

A Docker container is suspected of malicious activity. Which THREE data sources should the investigator collect for forensic analysis?

Select 3 answers
A.Network packet captures from the container's virtual interface
B.Host system audit logs
C.Docker image layer files
D.Container logs (stdout/stderr)
E.The Dockerfile used to build the image
AnswersB, C, D

Host system audit logs, such as those from auditd, systemd journal, or syslog, are the strongest artifact because the host kernel records container process activity in a way that survives container removal. These logs commonly capture container-ID-tagged process executions, file access, syscalls, and seccomp/AppArmor denials, allowing an investigator to reconstruct the container's interactions with the host. Unlike in-container logs, an attacker who deletes or overwrites files inside the container cannot easily erase the host-side audit trail.

Why this answer

Container logs, image layers, and host system logs are key sources in Docker forensics.

Practice this question →
8
MCQhard

During an investigation of a web application breach, an analyst reviews IIS logs and finds numerous entries with status code '200' and URIs containing '?cmd=' followed by encoded strings. The analyst also notices that some requests have a 'User-Agent' string resembling 'Microsoft-CryptoAPI/10.0'. What is the MOST likely conclusion?

A.The logs indicate a successful SQL injection attack
B.The logs show a cross-site scripting (XSS) attack targeting administrators
C.The server is infected with ransomware, encrypting files
D.A webshell is being used to execute commands on the server
AnswerD

The logs indicate a webshell is in use because the HTTP requests contain a cmd parameter whose values are operating-system commands, a classic hallmark of server-side web shells such as China Chopper or b374k. The non-standard User-Agent further suggests a customized or automated attacker tool, and the consistent use of this parameter across requests shows persistent remote access. This behavior is the result of a command injection vulnerability, where the web application fails to sanitize user input before passing it to the system shell, allowing the attacker to execute arbitrary commands directly against the server.

Why this answer

The presence of numerous HTTP 200 (success) responses with URIs containing '?cmd=' followed by encoded strings indicates that an attacker is sending command execution requests to a webshell on the server. The unusual User-Agent string 'Microsoft-CryptoAPI/10.0' is a known evasion technique used by webshell tools (e.g., China Chopper variants) to blend in with legitimate Windows update traffic. Successful command execution returns a 200 status, confirming the webshell is active and under attacker control.

Exam trap

The trap here is that candidates see '200 OK' and assume success of an attack like SQL injection, but the '?cmd=' parameter is the definitive indicator of a command execution webshell. EC-CHFI emphasizes recognizing webshell indicators such as encoded command parameters and unusual User-Agent strings.

How to eliminate wrong answers

Option A is wrong because SQL injection typically results in error codes (e.g., 500) or modified database responses, not consistent 200s with '?cmd=' parameters; the '?cmd=' pattern is characteristic of command execution, not SQL queries. Option B is wrong because XSS attacks inject client-side scripts into web pages and do not produce server-side command execution logs with '?cmd=' URIs; XSS would appear as reflected or stored script payloads in parameters like '?q=' or '?search='. Option C is wrong because ransomware encrypts files locally and communicates with C2 servers, but it does not generate repeated HTTP 200 responses with '?cmd=' in IIS logs; ransomware activity would show unusual file access patterns or encryption API calls, not webshell command execution.

Practice this question →
9
Multi-Selecthard

Which THREE of the following are common challenges specific to cloud forensics? (Select THREE)

Select 3 answers
A.Data jurisdiction and legal compliance across regions
B.Volatility of evidence due to auto-scaling and ephemeral instances
C.Inability to acquire physical hard drives
D.Lack of standardized log formats
E.High cost of forensic tools
AnswersA, B, C

Data may be stored in multiple countries with different laws.

Why this answer

Cloud forensic investigations must navigate data jurisdiction and legal compliance issues when data is stored across multiple geographic regions, each with its own data protection laws (e.g., GDPR, CLOUD Act). This creates challenges in obtaining lawful access to data that may be physically located in a jurisdiction where the investigator has no legal authority.

Exam trap

EC-Council often tests the distinction between general forensic challenges and those that are unique to cloud environments, so candidates mistakenly select 'Lack of standardized log formats' or 'High cost of forensic tools' because they are real issues, but they are not specific to cloud forensics.

Practice this question →
10
MCQeasy

An email forensic analyst receives a suspicious email and wants to trace its origin. Which email header field provides the most reliable information about the IP address of the sending SMTP server?

A.Return-Path
B.Received
C.DKIM-Signature
D.X-Originating-IP
AnswerB

The Received header is the standard, reliable source for tracing the sending server's IP address in email forensics. Each SMTP server that handles the message adds a Received header that records the IP address (and often the hostname) of the server from which it received the message, along with a timestamp. The first Received header (reading from the bottom of the message) identifies the original sender's server, while each subsequent header documents each hop in the delivery chain. These headers are added automatically by mail servers and are much more difficult to spoof than user-controlled headers, making them the primary evidence for IP identification.

Why this answer

The 'Received' header is the most reliable source for tracing the origin of an email because each SMTP server that handles the message adds a new 'Received' header at the top, recording the IP address of the sending server (from the HELO/EHLO handshake) and the receiving server. The bottommost 'Received' header typically contains the IP address of the original sending SMTP server, as it is added by the first receiving MTA. This field is standardized in RFC 5321 and is the primary forensic artifact for email source identification.

Exam trap

The EC-Council CHFI exam often tests the misconception that X-Originating-IP is the most reliable source because it appears to directly show the sender's IP, but candidates must remember it is a non-standard header that can be easily forged or omitted, whereas the 'Received' header chain is a mandatory, traceable part of the SMTP protocol.

How to eliminate wrong answers

Option A is wrong because the Return-Path header (RFC 5321) contains the envelope sender (bounce address), not the IP address of the sending server; it is set by the Mail User Agent or the final MTA and can be forged. Option C is wrong because the DKIM-Signature header (RFC 6376) contains a cryptographic signature and the selector domain (d=), but it does not directly reveal the sending SMTP server's IP address; it only indicates the domain claiming responsibility for the message. Option D is wrong because X-Originating-IP is a non-standard, proprietary header often added by webmail services (e.g., Hotmail, Yahoo) to log the client's IP, but it is not universally present, not part of the SMTP protocol, and can be omitted or spoofed by the originating server.

Practice this question →
11
MCQeasy

Which tool is specifically designed to analyze email headers, track the path of an email, and extract metadata such as originating IP and authentication results?

A.Volatility
B.Wireshark
C.EmailTracker
D.FTK Imager
AnswerC

EmailTracker parses email headers and provides detailed path and authentication info.

Why this answer

EmailTracker is specifically designed to parse email headers, trace the email's path through mail servers, and extract metadata such as the originating IP address, authentication results (SPF, DKIM, DMARC), and timestamps. Unlike general-purpose tools, it focuses solely on email header analysis and visualization, making it the correct choice for this task.

Exam trap

EC-Council often tests the distinction between network packet analysis tools (Wireshark) and email-specific header analysis tools (EmailTracker), trapping candidates who confuse live SMTP traffic capture with post-delivery email header forensics.

How to eliminate wrong answers

Option A is wrong because Volatility is a memory forensics framework used for analyzing RAM dumps, not for parsing email headers or tracking email paths. Option B is wrong because Wireshark is a network protocol analyzer that captures and inspects live network traffic (e.g., SMTP packets), but it does not parse stored email headers or extract metadata like originating IP from an email's header fields. Option D is wrong because FTK Imager is a disk imaging and data acquisition tool used for creating forensic images of storage media, not for analyzing email headers or extracting email metadata.

Practice this question →
12
MCQeasy

Which email header field is specifically used to verify that an email was not tampered with during transit and is signed by the sender's domain?

A.X-Originating-IP
B.Message-ID
C.Received
D.DKIM-Signature
AnswerD

DKIM-Signature contains a digital signature computed over selected canonicalized header fields and the message body using a private key held by the sending domain. The verifier retrieves the sender's public key from DNS (e.g., dkim._domainkey.example.com) to decrypt the hash and compare it to the hashed current content, thereby detecting any modification since signing. Because the signature is cryptographically bound to the message content and the signing domain, it specifically provides the required verification of both origin and integrity.

Why this answer

The DKIM-Signature header field is the correct answer because it provides a cryptographic signature that allows the receiver to verify that the email was not altered in transit and that it originated from the claimed domain. DKIM (DomainKeys Identified Mail) uses public-key cryptography, where the sender's domain publishes a public key in DNS, and the sending server signs the email with the corresponding private key. This ensures both integrity and domain-level authentication, directly matching the question's requirement.

Exam trap

A common misconception is that the Received header can verify integrity because it shows the mail path, but it lacks cryptographic signing and can be manipulated by any intermediate server. EC-Council expects you to know that only DKIM provides cryptographic integrity verification tied to the sender's domain.

How to eliminate wrong answers

Option A is wrong because X-Originating-IP is a non-standard header that records the IP address of the original sender's client, but it provides no cryptographic integrity verification or domain-level signing. Option B is wrong because Message-ID is a unique identifier for the email message, used for tracking and threading, but it has no security properties to verify tampering or sender domain authenticity. Option C is wrong because the Received header is added by each mail transfer agent (MTA) along the delivery path to trace the route, but it does not include a cryptographic signature and can be easily forged or modified by intermediate servers.

Practice this question →
13
MCQeasy

Which of the following is a unique challenge in cloud forensics compared to traditional digital forensics?

A.Encryption of data at rest
B.Lack of network connectivity
C.Inability to acquire disk images
D.Multi-tenancy and data isolation
AnswerD

Multi-tenancy is a defining architectural property of cloud computing, where multiple customers share the same physical hardware and storage. This creates a unique forensic challenge: isolating a target tenant's evidence without exposing or processing co-tenant data, which may be subject to privacy and legal protections. Investigators must use careful acquisition methods, such as provider-supported volume snapshots, and may need court orders tailored to prevent data leakage. The co-mingling of data across tenants is a challenge with no direct analog in traditional single-owner digital forensics.

Why this answer

In cloud forensics, multi-tenancy and data isolation present a unique challenge because multiple customers share the same physical infrastructure, and forensic investigators must ensure that data acquisition from one tenant does not inadvertently expose or contaminate another tenant's data. This requires careful coordination with the cloud provider to isolate logical boundaries, often using techniques like snapshot-based acquisition or API-driven evidence collection, which are not typical in traditional single-owner digital forensics.

Exam trap

The EC-Council CHFI exam often tests the misconception that encryption is the primary cloud forensic challenge, but the real unique issue is multi-tenancy and data isolation due to shared infrastructure and legal/privacy boundaries.

How to eliminate wrong answers

Option A is wrong because encryption of data at rest is a challenge in both cloud and traditional forensics; it is not unique to the cloud. Option B is wrong because lack of network connectivity is a general forensic challenge that can occur in any environment, not specific to cloud forensics. Option C is wrong because inability to acquire disk images is not a defining challenge; cloud forensics can acquire disk images via provider APIs or snapshots, though the process differs from physical acquisition.

Practice this question →
14
MCQmedium

Which of the following email headers is used to verify the domain of the sending server and is commonly used for authentication to prevent spoofing?

A.Content-Type
B.Received
C.X-Mailer
D.DKIM-Signature
AnswerD

DKIM-Signature provides a digital signature for domain verification.

Why this answer

DKIM-Signature is the correct answer because it is an email authentication method that uses a digital signature to verify the domain of the sending server. It allows the receiver to check that the email was not forged or altered during transit, directly preventing domain spoofing. This header is defined in RFC 6376 and is a core component of email authentication frameworks like DMARC.

Exam trap

EC-Council often tests the distinction between headers used for authentication (DKIM-Signature) versus headers used for routing or metadata (Received, X-Mailer), leading candidates to mistakenly choose Received because it shows server hops, but it does not verify domain ownership.

How to eliminate wrong answers

Option A is wrong because Content-Type is a MIME header that specifies the media type of the message body (e.g., text/plain or multipart/mixed) and has no role in authentication or spoofing prevention. Option B is wrong because Received is a trace header added by each mail transfer agent (MTA) along the delivery path; it is used for routing diagnostics and forensic tracing, not for verifying the sending domain's authenticity. Option C is wrong because X-Mailer is an informal header that indicates the email client software used to compose the message (e.g., Outlook or Thunderbird) and is easily forged, providing no security or authentication function.

Practice this question →
15
MCQeasy

An analyst examines the following Apache access log entry: 192.168.1.10 - - [10/Jan/2023:13:45:22 +0000] "GET /search.php?q=1%27%20UNION%20SELECT%201,2,3-- HTTP/1.1" 200 1234 "-" "Mozilla/5.0". Which attack is MOST likely indicated?

A.Path Traversal
B.SQL Injection
C.Cross-Site Scripting (XSS)
D.Remote File Inclusion
AnswerB

The UNION SELECT statement in the query parameter is a SQL injection technique to extract data from the database.

Why this answer

The log shows a UNION SELECT statement in the query parameter, indicating a SQL injection attempt. The URL-encoded single quote (') and comment (--) are classic SQLi payloads.

Practice this question →
16
MCQmedium

An email forensic analyst receives a suspicious email and wants to verify the originating IP address. The analyst extracts the email headers and sees multiple 'Received' fields. Which 'Received' header should the analyst consider as the most trustworthy source of the sender's IP?

A.The first 'Received' header at the top
B.The last 'Received' header at the bottom
C.The 'X-Originating-IP' header
D.The 'Return-Path' header
AnswerB

The bottommost Received header is chronologically the first hop recorded, inserted by the sender's first SMTP server or mail user agent at the time of submission. It is the deepest part of the routing chain and provides the closest traceable IP/HELO information to the true origin, making it the best evidence for identifying the actual source. Analysts rely on this header because subsequent servers append above it without altering its content in normal operation.

Why this answer

The last 'Received' header at the bottom is the most trustworthy because email headers are added in reverse chronological order: each mail server prepends its own 'Received' field to the top of the header block. Therefore, the bottommost 'Received' header represents the first hop from the sender's MTA (Mail Transfer Agent) or the originating client, making it the closest to the true source IP.

Exam trap

A common trap in CHFI is to assume headers are chronological from top to bottom, leading candidates to select the first 'Received' header as the origin. In reality, the bottommost header is the earliest hop.

How to eliminate wrong answers

Option A is wrong because the first 'Received' header at the top is the most recent addition, added by the recipient's mail server, not the sender's; it reflects the last hop, not the origin. Option C is wrong because 'X-Originating-IP' is a non-standard, optional header that may be set by the sender's webmail interface (e.g., Outlook Web Access) but is often absent, easily spoofed, or not present in SMTP-transmitted emails; it is not a reliable forensic source. Option D is wrong because the 'Return-Path' header (or envelope sender) contains the bounce address (MAIL FROM) and is set by the sender's MTA, but it does not carry the originating IP address; it is used for delivery failure notifications, not for IP traceability.

Practice this question →
17
MCQeasy

In an email header, which field typically contains the IP address of the original sending client?

A.Return-Path
B.Message-ID
C.Received
D.DKIM-Signature
AnswerC

The Received header is inserted by every SMTP server that handles the message, and each line records the IP address of the transmitting host, the receiving server, protocol information, and a timestamp. The bottommost Received line is the first one added, showing the connection from the originating client or its final relay. Therefore, forensically it is the go-to field for discovering the sending IP address.

Why this answer

The 'Received' field in an email header is added by each mail transfer agent (MTA) that processes the message, and the first 'Received' header (at the bottom of the header block) typically contains the IP address of the original sending client (the SMTP client that initiated the connection). This field records the 'from' IP and the 'by' host, making it the definitive source for tracing the origin of the email.

Exam trap

EC-Council often tests the misconception that the 'Return-Path' field contains the sender's IP address, when in fact it only holds the email address for bounce handling, not any network-layer information.

How to eliminate wrong answers

Option A is wrong because the 'Return-Path' field contains the envelope sender (the bounce address), not the IP address of the sending client; it is used for non-delivery reports, not for tracing the original source IP. Option B is wrong because the 'Message-ID' field is a unique identifier string generated by the sending MUA or MTA, but it does not contain any IP address information; it is used for message tracking and threading. Option D is wrong because the 'DKIM-Signature' field contains a cryptographic signature and associated domain information (e.g., d=domain), but it does not include the sending client's IP address; it is used for email authentication, not origin IP tracing.

Practice this question →
18
MCQmedium

In an AWS environment, a security analyst detects unusual API calls that created several IAM users with administrative privileges from an unfamiliar IP address. Which AWS service log should be examined first to identify the specific API calls and the IAM user that made them?

A.Amazon S3 access logs
B.AWS CloudWatch Logs
C.AWS CloudTrail
D.AWS Config
AnswerC

CloudTrail logs all AWS API calls, making it the primary source for investigating API activity.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including the identity of the caller (IAM user or role), the source IP address, and the specific API actions (e.g., CreateUser, AttachUserPolicy). In this scenario, CloudTrail logs will directly show which IAM user made the unusual API calls from the unfamiliar IP address, enabling the analyst to trace the unauthorized activity.

Exam trap

EC-CHFI often tests the distinction between CloudTrail (API activity logging) and CloudWatch Logs (monitoring and log aggregation), leading candidates to mistakenly choose CloudWatch Logs because they think 'logs' implies all logging, but CloudTrail is the specific service for API call auditing.

How to eliminate wrong answers

Option A is wrong because Amazon S3 access logs record requests made to S3 buckets (e.g., GET, PUT, DELETE objects), not IAM management API calls like creating users or assigning policies. Option B is wrong because AWS CloudWatch Logs is a service for monitoring, storing, and accessing log files from various sources (e.g., application logs, system logs), but it does not natively capture AWS API calls; it can only ingest CloudTrail logs if configured, but it is not the primary source for API call records. Option D is wrong because AWS Config is a service for evaluating and auditing resource configurations and compliance over time, not for recording real-time API calls or identifying the specific user who made them.

Practice this question →
19
Multi-Selectmedium

A forensic analyst is examining MySQL binary logs to identify a data exfiltration event. Which TWO fields are most critical for reconstructing the stolen data?

Select 2 answers
A.Error code
B.Timestamp
C.Server ID
D.SQL statement
E.Thread ID
AnswersB, E

Binlog event headers include a timestamp (in seconds since epoch) that enables forensic reconstruction of the exact order in which transactions occurred. This chronology is essential for correlating binlog events with other logs (e.g., access logs) to pinpoint when data was accessed and exfiltrated, and for establishing a timeline of an attacker's actions.

Why this answer

Timestamp (B) is critical for reconstructing the stolen data because it establishes the exact sequence of events, allowing correlation with other logs (e.g., general query log) to pinpoint when exfiltration occurred. Thread ID (E) uniquely identifies the database connection; by correlating thread IDs across binary logs and general query logs, the analyst can trace all queries (including SELECTs) executed by the same connection, revealing the exfiltration queries that are not recorded in binary logs. Together, these fields enable chronological and connection-based reconstruction, compensating for the binary log's lack of SELECT logging.

Exam trap

EC-Council often tests the misconception that SQL statements are always present in binary logs. However, binary logs only record data-changing operations (INSERT, UPDATE, DELETE, DDL), not SELECT queries used for typical data exfiltration. The critical fields for reconstructing stolen data from binary logs are timestamp and thread ID, which allow correlation with other logs that capture the actual SELECT statements.

Practice this question →
20
Multi-Selecthard

During a forensic analysis of a compromised web server, an investigator identifies the following log entries. Which THREE entries are the strongest indicators of a successful web shell upload? (Choose three.)

Select 3 answers
A.POST /upload.php HTTP/1.1 200 0
B.POST /uploads/shell.aspx HTTP/1.1 200 - -
C.GET /uploads/shell.aspx?cmd=dir HTTP/1.1 200 - -
D.GET /../../windows/system32/cmd.exe HTTP/1.1 404 - -
E.GET /images/logo.png HTTP/1.1 304 - -
AnswersA, B, C

A POST request to /upload.php that returns HTTP 200 with a zero-byte response body indicates the server accepted a client upload even though the reply was empty. In Apache access logs, the trailing '0' is the response size in bytes, so this record is consistent with a PHP upload handler completing successfully and not returning content. Combined with the known purpose of upload.php, this is a strong forensic foothold for a web shell planted through the application's file-upload feature.

Why this answer

Successful uploads of aspx or php files that contain web shell code (e.g., with cmd parameter) and subsequent access to those files are strong indicators. The 404 for cmd.exe indicates a path traversal attempt, not a web shell.

Practice this question →
21
MCQmedium

During a database forensic investigation, you need to review Microsoft SQL Server transaction logs to identify unauthorized data modifications. Which of the following SQL Server functions or commands is used to read the transaction log?

A.SELECT * FROM sys.dm_tran_database_transactions
B.DBCC LOG
C.fn_dblog
D.BACKUP LOG
AnswerC

fn_dblog is a table-valued function that accepts a starting and ending LSN and returns every transaction log record in that range, with columns such as Current LSN, Operation, Context, Transaction ID, Description, AllocUnitName, Page ID, and decoded row data. It allows an investigator to filter by operation type, transaction ID, or database object to reconstruct insert/update/delete activity, page allocations, and schema changes directly from the log. This makes it the standard, structured method for reviewing the actual log records during a database forensic investigation.

Why this answer

The fn_dblog function is the correct choice because it is the undocumented but widely used SQL Server function that reads the transaction log (LDF file) directly, allowing forensic examiners to view every logged operation including data modifications, schema changes, and transaction details. Unlike other DMVs or commands, fn_dblog provides a row-by-row dump of the log records, making it essential for identifying unauthorized changes at the transaction level.

Exam trap

EC-Council often tests the distinction between deprecated commands (DBCC LOG) and their modern replacements (fn_dblog), leading candidates to choose the familiar but outdated option B instead of the correct function C.

How to eliminate wrong answers

Option A is wrong because sys.dm_tran_database_transactions is a dynamic management view that shows metadata about currently active transactions (e.g., transaction ID, state, log space usage), but it does not read the actual transaction log records or provide historical log content. Option B is wrong because DBCC LOG is an undocumented command that was used in older SQL Server versions (prior to 2005) to read the transaction log, but it has been deprecated and replaced by fn_dblog; in modern SQL Server, DBCC LOG is no longer available or functional. Option D is wrong because BACKUP LOG is a command used to back up the transaction log to a file for point-in-time recovery, not to read or inspect the log contents for forensic analysis.

Practice this question →
22
MCQeasy

Which cloud service log is most appropriate for tracking API calls and resource changes in an AWS environment?

A.AWS VPC Flow Logs
B.AWS Config
C.AWS CloudTrail
D.AWS CloudWatch Logs
AnswerC

CloudTrail records all API calls and resource changes for auditing.

Why this answer

AWS CloudTrail is the service that records API activity and resource changes.

Practice this question →
23
MCQhard

A forensic analyst is investigating a Docker container that was used to launch a network attack. The container has been stopped but not removed. Which action should the analyst take FIRST to preserve volatile evidence?

A.Restart the container and use 'docker exec' to collect evidence
B.Use 'docker inspect' to view container metadata only
C.Use 'docker save' to export the container as a tar file
D.Use 'docker commit' to create an image of the container
AnswerD

'docker commit' captures the container's current writable layer into a new image, preserving the filesystem state at a defined moment without modifying the original container's content. By default, Docker pauses the container during the commit, giving a point-in-time consistent snapshot that can be exported with 'docker save' and analyzed in a sandbox. This method is the best option listed because it preserves the container's filesystem evidence in a non-destructive way, although it does not capture live memory or active network connections.

Why this answer

Preserving the container's file system and logs is key. 'docker commit' creates an image from the container's current state. 'docker export' exports the filesystem as a tar archive. 'docker logs' retrieves logs. 'docker inspect' shows metadata. The container is stopped, so 'docker exec' won't work without starting it, which alters state. 'docker save' saves images, not containers. The best first step is to create an image or export the filesystem.

Practice this question →
24
MCQeasy

Which of the following email authentication protocols uses a digital signature to verify the sender's domain and that the email has not been tampered with?

A.DMARC
B.DKIM
C.SPF
D.STARTTLS
AnswerB

DKIM (DomainKeys Identified Mail) is the protocol that adds a digital signature to email headers, specifically a DKIM-Signature header containing a base64-encoded signature. The signing domain uses its private key to sign selected header fields and the message body, while the receiving MTA retrieves the public key via a TXT record in DNS (e.g., selector._domainkey.example.com) and verifies the signature. This cryptographically ties the message to the domain and ensures the signed content was not altered in transit.

Why this answer

DKIM (DomainKeys Identified Mail) is the correct answer because it uses a digital signature (an encrypted hash) added to the email header, which is verified against a public key published in the sender's DNS TXT record. This cryptographic process confirms that the email originated from the claimed domain and that the message body and key headers have not been altered in transit, ensuring integrity and authenticity.

Exam trap

A common trap in the EC-CHFI exam is that candidates confuse STARTTLS's transport-layer encryption with message-level authentication, leading them to pick D instead of the correct digital signature protocol.

How to eliminate wrong answers

Option A (DMARC) is wrong because DMARC is a policy framework that uses SPF and DKIM results to instruct receivers on how to handle unauthenticated mail (e.g., quarantine or reject); it does not itself create or verify digital signatures. Option C (SPF) is wrong because SPF only checks the envelope sender (Return-Path) against a list of authorized IP addresses in DNS; it provides no cryptographic integrity or tamper detection. Option D (STARTTLS) is wrong because STARTTLS is a protocol command (defined in RFC 3207) that upgrades an existing plaintext SMTP connection to an encrypted TLS session; it protects the channel but does not authenticate the sender's domain or verify message integrity after delivery.

Practice this question →
25
MCQmedium

Which Azure log source should an investigator query to identify who deleted a virtual machine and when?

A.Azure Activity Log
B.Azure Active Directory sign-in logs
C.Azure Diagnostic Settings for the VM
D.Network Security Group flow logs
AnswerA

Activity Log records resource management operations (create, update, delete).

Why this answer

The Azure Activity Log (formerly known as Audit Logs) is the subscription-level log that records all control-plane operations on Azure resources, including virtual machine creation, deletion, and modification. When a VM is deleted, the Activity Log captures the operation name (e.g., 'Microsoft.Compute/virtualMachines/delete'), the caller's identity (user or service principal), the timestamp, and the status of the operation. This makes it the authoritative source for answering 'who deleted a VM and when'.

Exam trap

Candidates often confuse authentication logs (such as sign-in logs) with resource operation logs (such as activity logs). Authentication logs only show login events, not the actions performed after login. To determine who deleted a VM, you need the activity log that records control-plane operations.

How to eliminate wrong answers

Option B is wrong because Azure AD sign-in logs track authentication events (user logins, MFA challenges, token issuance) but do not record resource-level operations like VM deletion; they are identity-focused, not resource-focused. Option C is wrong because Azure Diagnostic Settings for a VM collect guest OS-level logs (e.g., event logs, performance counters, IIS logs) and are not aware of control-plane operations such as VM deletion, which occur at the Azure Resource Manager layer. Option D is wrong because Network Security Group flow logs capture IP traffic flows (source/destination IP, port, protocol) through NSGs and are used for network forensics, not for tracking who performed a resource management action like deleting a VM.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Application, Email and Cloud Forensics questions.

Start 20-question session