Email and Social Media Forensics CHFI Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What type of information can be extracted from email server logs to help reconstruct email activity?

   • AThe full content of email bodies
   • BThe user's social media posts
   • CThe user's browsing history
   • DSender and recipient email addresses, timestamps, and message IDs
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company's mail server logs show that a user's account sent a large volume of emails to an external address at 2:00 AM. The user claims they were asleep and did not send the emails. The emails have a 'Received' header showing the originating IP as a VPN service provider. The company uses multi-factor authentication (MFA) for email access. Which conclusion is most defensible?

   • AThe account was compromised because the VPN IP indicates an external attacker bypassed MFA.
   • BThe account was not compromised because MFA prevents unauthorized access.
   • CThe emails are definitely spoofed because the originating IP is from a VPN provider.
   • DThe user likely sent the emails from a device using a VPN, and the MFA event should be checked to confirm.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A forensic analyst is examining a photo posted on a suspect's Twitter account. The photo was downloaded from the tweet. The analyst wants to determine the device that took the photo and the exact time it was taken. Which of the following is the most reliable method?

   • ACheck the tweet's timestamp, which indicates when the photo was taken.
   • BUse the photo's resolution and file size to estimate the device.
   • CExamine the EXIF metadata of the downloaded photo for camera model and DateTimeOriginal.
   • DLook at the photo's file name, which often contains the device model and timestamp.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An investigator is tasked with building a digital footprint of a suspect based on publicly available social media profiles. The suspect is known to use the username 'shadow_walker' on multiple platforms. The investigator needs to document evidence that will be admissible in court. Which approach best balances thoroughness and legal admissibility?

   • APrint the profile pages and manually note the information in a notebook.
   • BAsk a colleague to friend the suspect and download private posts.
   • CLog in to the suspect's accounts using credentials found on the suspect's computer.
   • DUse a dedicated social media intelligence tool to capture profile data and save screenshots with timestamps and source URLs.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is a common location for social media app data on an Android device?

   • A/etc/
   • B/data/data/<package_name>/
   • C/system/
   • D/mnt/sdcard/
   Reveal Solution Discussion Select an answer first