Investigating Web Attacks CHFI Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which piece of metadata is most commonly used to trace the origin of a web attack?

   • AThe web server's SSL certificate
   • BThe server's hostname
   • CThe attacker's MAC address
   • DThe source IP address in the HTTP request
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An investigator is analyzing Apache access logs and notices a series of requests with the same source IP but different User-Agent strings, each requesting a different URL path that doesn't exist on the server. What does this pattern most likely indicate?

   • AA distributed denial-of-service (DDoS) attack flooding the server with requests.
   • BA legitimate user with multiple browsers accessing the site.
   • CA misconfigured proxy server that is caching and replaying requests.
   • DA web crawler or scanner probing for common vulnerabilities or hidden directories.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a non-volatile artifact that can be recovered from a compromised web server?

   • ANetwork connections
   • BARP cache
   • CBrowser cache files
   • DProcess memory
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A web application was defaced, and the investigator suspects the attacker exploited a file upload vulnerability. Which source-code inspection would be most likely to reveal the vulnerability?

   • AReviewing the authentication module to see if session tokens are properly generated.
   • BReviewing the error handling code to see if stack traces are exposed.
   • CReviewing the database connection strings for hardcoded credentials.
   • DReviewing the file upload handler to see if it validates file extensions and content-type headers.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An investigator is preparing a forensic report for a web attack. The report must be understandable to a non-technical judge. The investigator has a large amount of technical data, including raw logs, packet captures, and memory dumps. Which approach is most effective for presenting the findings?

   • ASummarize only the conclusions without any supporting evidence.
   • BProvide a high-level executive summary with visual timelines and plain-language explanations, and include technical details in appendices.
   • CInclude all raw logs and packet captures in the main body to show the complete evidence.
   • DUse technical jargon throughout to demonstrate the investigation's thoroughness.
   Reveal Solution Discussion Select an answer first