CHFI Application, Email and Cloud Forensics Practice Question
During a cloud forensic investigation, the analyst discovers that the suspect used AWS IAM credentials to launch unauthorized EC2 instances. The suspect claims the credentials were stolen. Which log would the analyst examine to determine the source IP address from which the credentials were used?
⚠ Common exam trap
EC-Council CHFI exams often test the distinction between network-level logs (VPC Flow Logs) and API-level logs (CloudTrail), leading candidates to mistakenly choose VPC Flow Logs because they associate 'source IP' with network traffic rather than API call metadata.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail records all API calls made to the AWS environment, including the `RunInstances` action that launches EC2 instances. Each CloudTrail event contains the `sourceIPAddress` field, which captures the IP address from which the IAM credentials were used. This makes CloudTrail the definitive log to identify the origin of the unauthorized activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC Flow Logs
Why it's wrong here
VPC Flow Logs capture only IP traffic metadata at the elastic network interface level, recording fields such as source/destination IP addresses, ports, protocol, packets, and bytes for allowed or rejected network flows. They do not log the identity of the AWS principal, the API operation name, or user agent, so they cannot reveal which user invoked a specific cloud API call or the origin of that API request in terms of IAM credentials.
- ✗
Amazon Inspector findings
Why it's wrong here
Amazon Inspector is a vulnerability management service that performs automated security assessments of workloads, scanning for software vulnerabilities (CVEs), unintended network exposure, and deviations from security best practices. Its findings are asset-centric and describe security weaknesses or compliance failures, not audit records of API activities. Consequently, Inspector cannot provide the caller identity or source IP for cloud management API calls, which is what a forensic analyst needs to attribute actions.
- ✗
AWS Config
Why it's wrong here
AWS Config primarily tracks configuration changes to AWS resources over time, maintaining a resource inventory and configuration history, and can assess compliance against custom or managed rules. While it can tell you what resource attribute changed (e.g., a security group rule was modified) and sometimes which API call caused it via integrated CloudTrail events, it does not independently capture the source IP address, IAM user/role, or user agent of the API requester. Its core purpose is configuration state and compliance, not a detailed trail of API call origin.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is the authoritative service for API activity logging in AWS, recording every management event (and optionally data events) as a CloudTrail log file. Each event includes the user identity (IAM user, role, or federated principal), source IP address, user agent, AWS region, event name, request parameters, and response elements. This enables a forensic analyst to trace exactly which API call was made, by whom, and from which IP address, making it the correct source for determining API call origin during an investigation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.