Investigating Web Attacks CHFI Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is an indicator of compromise (IoC) that might appear in a web server access log?

   • AA request for '/etc/passwd' using a path traversal sequence
   • BA normal GET request for the homepage
   • CA user-agent string of 'Mozilla/5.0'
   • DA 200 OK response to a valid page
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary objective of a web attack investigation?

   • ATo patch vulnerabilities and restore the system to normal operation
   • BTo determine the root cause, scope, and impact of the attack and preserve evidence
   • CTo identify the attacker's identity and prosecute them
   • DTo collect as much data as possible from the compromised system
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A web server log contains the following entry: GET /search.php?q=<script>alert('XSS')</script> HTTP/1.1. Which attack signature does this entry most clearly indicate?

   • ASQL injection, because the query parameter is being manipulated.
   • BCommand injection, because the script tag is executed by the operating system.
   • CDirectory traversal, because the script tag is used to navigate directories.
   • DCross-site scripting (XSS), because the payload contains HTML/JavaScript that could be reflected to the user.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which configuration file is commonly examined to identify how a web application handles user input?

   • AThe operating system's kernel configuration
   • BThe network firewall rules
   • CThe web server's main configuration file (e.g., httpd.conf)
   • DThe application's configuration file (e.g., web.config or application.properties)
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An investigator is tracing the origin of a web attack and has identified the attacker's IP address from the logs. However, the IP address belongs to a cloud provider. What is the most important next step to determine the actual attacker?

   • APerform a reverse DNS lookup on the IP address to find the hostname.
   • BContact the cloud provider with a legal request to obtain the account information associated with that IP at the time of the attack.
   • CUse a geolocation service to find the physical location of the IP address.
   • DCheck the IP address against threat intelligence feeds to see if it's known for malicious activity.
   Reveal Solution Discussion Select an answer first