Why is it important to correlate network captures with application logs during a web attack investigation?

To identify the attacker's physical location

To determine if the server hardware is failing

To reconstruct the complete attack path from network packets to application behavior

To verify that the application logs are authentic

Which of the following is a volatile artifact that should be collected first during a web attack investigation?

Memory dump of the web server process

Temporary files on the hard drive

An investigator is examining a web application's source code after a suspected SQL injection attack. Which code pattern would most strongly confirm the vulnerability that was exploited?

A configuration file that sets the application's error reporting to 'display_errors = Off'.

A query built by concatenating user input directly into a SQL string without parameterization.

An HTML form that uses client-side JavaScript validation for input fields.

A prepared statement that uses parameterized queries for all database access.

After a web attack, an investigator needs to recover artifacts from a compromised server. Which artifact is most likely to contain the attacker's in-memory exploit code?

The browser cache on the attacker's machine.

The web server's configuration file.

A memory dump of the server process.

A company has experienced a web attack. The incident response team needs to define the scope and objectives of the forensic investigation. Which statement best defines the primary objective?

To identify the attacker's identity and prosecute them in court.

To patch the vulnerabilities that were exploited during the attack.

To restore the affected systems to normal operation as quickly as possible.

To determine the attack vector, the extent of compromise, and to preserve evidence for potential legal action.

EC-CouncilComputer Hacking Forensic Investigator

Domain 5Objective 1

Investigating Web Attacks CHFI Practice Questions (Page 5)

Part of the Web and Dark Web Forensics domain, which makes up ~13% of our current practice bank.

48questions here

10free pages

8concepts

Questions 21–25

21foundation · easy
Why is it important to correlate network captures with application logs during a web attack investigation?
Select an answer first
22foundation · easy
Which of the following is a volatile artifact that should be collected first during a web attack investigation?
Select an answer first
23application · medium
An investigator is examining a web application's source code after a suspected SQL injection attack. Which code pattern would most strongly confirm the vulnerability that was exploited?
Select an answer first
24application · medium
After a web attack, an investigator needs to recover artifacts from a compromised server. Which artifact is most likely to contain the attacker's in-memory exploit code?
Select an answer first
25application · medium
A company has experienced a web attack. The incident response team needs to define the scope and objectives of the forensic investigation. Which statement best defines the primary objective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.