Investigating Web Attacks CHFI Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which field in a standard web server access log is most useful for correlating requests from the same source?

   • AThe client IP address
   • BThe timestamp
   • CThe request URI
   • DThe HTTP status code
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A forensic investigator is analyzing an IIS web server's logs after a suspected SQL injection attack. The investigator notices many HTTP 500 errors in the error log, but the access log shows only a few requests to the vulnerable page. Which log-analysis step would most directly help confirm the attack and identify the injected payload?

   • ASearch the error log for the string 'SQL' and assume every match is an attack attempt.
   • BCorrelate the timestamps of the HTTP 500 errors with the access log entries for the vulnerable page and extract the query strings from those entries.
   • CCount the total number of HTTP 500 errors and report that as the number of attack attempts.
   • DCheck the IIS 'failed request tracing' logs only, ignoring the access log because the error log already shows the attack.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of a forensic report in a web attack investigation?

   • ATo document findings in a clear and admissible manner for legal proceedings
   • BTo recommend security patches
   • CTo provide a detailed technical analysis for IT staff
   • DTo assign blame to specific individuals
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company's web application was compromised. The investigation reveals that the attacker used a SQL injection vulnerability to extract data. The web server logs show the attack originated from a single IP address, but the company's firewall logs show the same IP address was used for a brief period. The company's legal team wants to know if the attacker can be identified. Which factor is most critical in determining the likelihood of identifying the attacker?

   • AWhether the IP address is a static or dynamic address assigned by the ISP.
   • BWhether the web server logs include the User-Agent string.
   • CWhether the company has a threat intelligence subscription.
   • DWhether the firewall logs show the destination port used.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An investigator is preparing a forensic report for a web attack. The report must be admissible in court. Which practice is most important to ensure the report's admissibility?

   • AUse technical jargon to demonstrate expertise.
   • BInclude the investigator's personal opinion about the attacker's identity.
   • CSummarize the findings without including raw log excerpts.
   • DDocument the chain of custody for all evidence and include hashes of the original evidence.
   Reveal Solution Discussion Select an answer first