Investigating Web Attacks CHFI Practice Questions (Page 10)

Questions 46–48

1. 46application · medium

   During an investigation of a web breach, an analyst has a network packet capture (PCAP) showing outbound HTTPS traffic from the web server to an external IP, and a proxy log showing a POST request to a URL that matches a known command-and-control pattern. However, the web server's access log does not show the corresponding request. What is the most likely reason for this discrepancy, and what should the analyst do next?

   • AThe request was made directly to the web server's IP address, bypassing the host header, so the access log did not record it; the analyst should check the raw TCP streams in the PCAP.
   • BThe access log was rotated and overwritten before the analyst could collect it; the analyst should recover the log from the backup.
   • CThe request was not sent to the web server at all; it was outbound C2 traffic from a compromised process, so the analyst should focus on the PCAP and proxy log to trace the malware's behavior.
   • DThe traffic was encrypted, so the proxy log captured the domain but the web server's access log only records decrypted requests; the analyst should decrypt the PCAP using the server's private key.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which element is essential for a forensic report to be considered admissible in court?

   • AThe use of proprietary forensic tools
   • BA recommendation for prosecution
   • CA detailed explanation of the attacker's motives
   • DA chain of custody for all evidence
   Reveal Solution Discussion Select an answer first
3. 48expert · hard

   An investigator is correlating a web attack. The web server access log shows a POST to /upload.php from IP 192.0.2.10 at 12:00:00. The network capture shows the same POST, but the packet payload contains a malicious PHP file. The application log shows the file was saved to /var/www/uploads/shell.php. Which additional evidence would best confirm that the attacker executed the uploaded shell?

   • AA subsequent GET request to /uploads/shell.php in the access log.
   • BThe presence of the uploaded file in the server's file system.
   • CThe network capture shows the file upload was successful (HTTP 200).
   • DA subsequent POST request to /uploads/shell.php with a command parameter.
   Reveal Solution Discussion Select an answer first