Investigating Web Attacks CHFI Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which data source would provide the most complete view of a web attack that involved multiple requests from different IP addresses?

   • AWeb server access logs
   • BNetwork packet captures
   • CProxy server logs
   • DCombining network captures, proxy logs, and application logs
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   During a web attack investigation, the investigator must preserve evidence but the server is a critical production system that cannot be taken offline. Which approach best balances forensic soundness with operational continuity?

   • APerform a live memory dump and then image the disk while the server is running, using volume shadow copies.
   • BCopy only the web server logs and configuration files to an external drive.
   • CWait until the server is naturally idle, then perform a full forensic image.
   • DShut down the server immediately to preserve evidence, even though it causes downtime.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A web server's access log shows a series of requests to /product.php?id=1, /product.php?id=2, and so on, up to /product.php?id=1000, all from the same IP within 30 seconds. The site's product IDs are UUIDs. Which log analysis step would most directly confirm whether this is an automated enumeration attempt?

   • ASearch the access log for the IP in the firewall logs to determine if the traffic originated from a known proxy.
   • BCheck the User-Agent string and request rate to identify a scripted client, then verify if any responses returned valid product data.
   • CCorrelate the access log timestamps with the web server's error log to see if any requests returned 500 errors.
   • DReview the web application's source code to see if the product.php endpoint has an input validation filter.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A forensic investigator is tracing a web attack. The web server access log shows a POST to /login.php from IP 203.0.113.5 at 10:00:00. The application log shows a successful login for user 'admin' at 10:00:01. The network capture shows a TCP handshake from 203.0.113.5 to the server at 09:59:59. Which conclusion is best supported by correlating these data sources?

   • AThe attacker used a botnet to distribute the login request across multiple IPs.
   • BThe login request was proxied through a VPN, so the true origin cannot be determined.
   • CThe attacker used a cross-site scripting (XSS) payload to hijack the admin session.
   • DThe login request originated from 203.0.113.5 and the successful authentication is directly linked to that request.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   When examining web application source code for forensic purposes, what is the investigator primarily looking for?

   • AThe application's performance bottlenecks
   • BThe original developer's coding style
   • CThe license of third-party libraries
   • DCode that was modified or injected by the attacker
   Reveal Solution Discussion Select an answer first