Investigating Web Attacks CHFI Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An investigator is tracing a web attack. The access log shows the attack came from IP 203.0.113.5, but the network capture shows that IP 203.0.113.5 is a known Tor exit node. The attacker also used a spoofed X-Forwarded-For header showing 198.51.100.2. Which conclusion is best supported?

   • AThe attacker is located at 198.51.100.2 because the X-Forwarded-For header is set by the server.
   • BThe immediate source is 203.0.113.5 (the Tor exit node), but the true origin is obscured by Tor.
   • CThe attack originated from the Tor network, so attribution is impossible.
   • DThe true origin is 198.51.100.2, as indicated by the X-Forwarded-For header.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A forensic team is investigating a web attack that involved a drive-by download. The team has a memory dump from the compromised machine and a network capture. The memory dump shows a suspicious process that made an outbound connection, and the network capture shows the corresponding traffic. However, the team cannot determine what the process did. Which additional artifact would be most useful to understand the process's behavior?

   • AThe system's event logs, which may show when the process was created.
   • BThe network capture's DNS queries, which show the domains resolved by the process.
   • CThe process's executable file on disk, which can be reverse-engineered.
   • DThe browser's history file, which shows the URLs visited before the download.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An investigator is tracing the origin of a web attack. The attacker used a VPN service, and the web server logs show the VPN's exit IP address. Which additional data source would be most useful to potentially identify the attacker's true IP address?

   • AThe VPN provider's connection logs, which may contain the user's real IP address and connection timestamps.
   • BThe web server's DNS logs, which show the domain names resolved by the attacker.
   • CThe attacker's browser fingerprint, which can be extracted from the HTTP headers.
   • DThe web server's firewall logs, which show the source IP of the VPN exit node.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An investigator is analyzing web server logs after a successful SQL injection attack. The logs show that the attack came from an IP address that is now part of a VPN service's address pool. The investigator has obtained a court order for the VPN provider's logs, but the provider states that they do not keep logs. Which alternative approach is most likely to help identify the attacker?

   • APerform a reverse DNS lookup on the VPN exit IP to find the hostname.
   • BContact the VPN provider's upstream ISP for connection logs.
   • CAnalyze the web server's memory dump for remnants of the attacker's session or tools.
   • DCheck the web server's access logs for the attacker's User-Agent string.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In network traffic, which pattern is a signature of a SQL injection attempt?

   • AA request for a JavaScript file with a .js extension
   • BA request with a 'Referer' header pointing to a search engine
   • CA GET request with a long string of 'A' characters
   • DA POST request containing 'OR 1=1' in a parameter
   Reveal Solution Discussion Select an answer first