Email and Social Media Forensics CHFI Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A company's mail server administrator notices a large number of outbound emails from a single user account during off-hours. The emails are being sent to external addresses and contain unusual attachments. As a forensic investigator, you need to determine whether the account was compromised or the user is sending data externally. Which server-side artifact would provide the most comprehensive evidence of the email activity, including sender IP, recipient addresses, and timestamps?

   • AThe mail server's message tracking logs.
   • BThe user's local Outlook OST file.
   • CThe firewall's network traffic logs.
   • DThe DNS server's query logs.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   During an investigation, you need to trace the origin of a phishing email that was received by an employee. You have the full email headers and access to the company's mail server logs. The 'Received' chain shows the message passed through three servers: the company's Exchange server, an external relay, and an unknown server. The last 'Received' header (the first one listed) contains an IP address. What is the most reliable next step to identify the sender's IP address?

   • ALook up the IP in the first Received header (the last one listed) because it is the first server that handled the email.
   • BUse the IP address in the last Received header as the sender's IP.
   • CCorrelate the Received headers with the mail server logs to verify each hop and identify the true originating IP.
   • DCheck the X-Originating-IP header, which always contains the sender's true IP.
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A suspect posted a photo on Instagram that allegedly shows a confidential document. The investigator wants to determine the exact time and location where the photo was taken. The photo was downloaded from Instagram. Which metadata source would be most reliable for this purpose?

   • AThe image's pixel dimensions and file size.
   • BThe EXIF metadata embedded in the original photo file, if available.
   • CThe file creation and modification timestamps from the suspect's device.
   • DThe timestamp and location tags displayed on the Instagram post.
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   Which of the following is a primary source for recovering deleted webmail messages from a computer?

   • ABrowser cache and temporary internet files
   • BEmail client's sent items folder
   • CSMTP server logs
   • DDNS cache
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   During an internal investigation, you need to recover emails that a user sent and received via Microsoft Outlook on a Windows 10 workstation. The user's mailbox is hosted on an on-premises Exchange server, but the user also used Outlook in cached mode. The user has since deleted several emails from the mailbox. Which forensic artifact would most likely contain remnants of the deleted emails?

   • AThe user's Outlook OST file located in the local AppData folder.
   • BThe Windows Prefetch files for Outlook.exe.
   • CThe user's browser history and cache files.
   • DThe Exchange server's transport pipeline logs.
   Reveal Solution Discussion Select an answer first