Question 204 of 205
Webshell Indicators: Key Signs of a Compromised Web Server
Which THREE of the following are indicators of a webshell compromise on a web server?
Quick Answer
The answer is unexpected outbound connections from the web server to unknown IP addresses, along with unusual files in web directories and high CPU usage due to command execution. These three indicators are classic signs of a webshell compromise because a webshell is essentially a malicious script uploaded to a web server that allows an attacker to execute system commands remotely. When the attacker runs commands like whoami or netstat, the server’s CPU spikes, and the script often spawns outbound connections to exfiltrate data or receive further instructions. On the Computer Hacking Forensic Investigator CHFI exam, this question tests your ability to correlate forensic artifacts with active compromise, often appearing in the web server forensics domain. A common trap is focusing only on file anomalies while ignoring behavioral indicators like traffic patterns. Memory tip: think “Files, CPU, Outbound” as the three pillars of webshell detection.
⚠ Common exam trap
Candidates often mistake normal administrative behavior (Option B) for suspicious activity, but webshells bypass authentication entirely, making regular successful logins irrelevant as indicators.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
High CPU usage from web server processes
A webshell often executes malicious commands via the web server's process (e.g., Apache's httpd or IIS's w3wp.exe). This causes sustained high CPU usage because the webshell may be running resource-intensive tasks like password cracking, data exfiltration, or cryptomining within the web server's process context, which is a strong indicator of compromise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
High CPU usage from web server processes
Why this is correct
Execution of arbitrary commands or scripts can spike CPU usage.
- ✗
Regular successful logins to the server with correct credentials
Why it's wrong here
This is expected behavior and not indicative of a webshell.
- ✓
Presence of files with extensions like .php, .asp, or .jsp in web directories that are not part of the original application
Why this is correct
Webshells are often uploaded as script files to web directories.
- ✓
Unexpected outbound connections from the web server to unknown IP addresses
Why this is correct
Webshells often initiate outbound connections to exfiltrate data or receive commands.
- ✗
Decrease in network traffic
Why it's wrong here
Webshells typically cause an increase in network traffic due to exfiltration or command execution.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CHFI
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following are common indicators of a web shell presence on a compromised IIS web server? (Select THREE.)
hard- A.Increased 404 errors in HTTP logs
- ✓ B.Process w3wp.exe making outbound connections to an unknown IP
- ✓ C.Scheduled tasks that execute cmd.exe or powershell.exe
- ✓ D.Anomalous files with .asp or .aspx extensions in the wwwroot directory
- E.Normal GET requests to static .html pages
Why B: W3wp.exe is the IIS worker process for ASP.NET applications. A compromised web shell often causes this process to initiate outbound connections to a command-and-control (C2) server or to exfiltrate data, which is anomalous since legitimate IIS worker processes typically do not make outbound connections to unknown external IP addresses.
Variation 2. Which THREE of the following are common indicators of a web shell on a compromised web server? (Select THREE.)
hard- A.Presence of .htaccess files with rewrite rules
- ✓ B.Files with obfuscated code (e.g., base64 encoded strings)
- ✓ C.Files located in web-accessible directories (e.g., /uploads) with execute permissions
- D.High number of 404 errors in access logs
- ✓ E.Unusual HTTP POST requests with large payloads to a single script
Why B: Web shells often use obfuscated code, such as base64-encoded strings, to hide malicious commands from security tools and system administrators. Option C is correct because web shells are typically placed in web-accessible directories like /uploads and require execute permissions to run commands. Option E is correct because web shells often receive large POST payloads containing commands, which is abnormal for normal scripts. Option A is incorrect; .htaccess rewrite rules are a legitimate Apache feature and not a direct indicator of a web shell. Option D is incorrect; while web shells may cause 404 errors, a high number of 404s is not a specific indicator of a web shell.
Last reviewed: Jul 4, 2026
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.