Which of the following is a common web attack vector that a forensic investigator should be familiar with?

Buffer overflow in a kernel driver

A security analyst is investigating a web attack. The web server logs show a series of requests with the same source IP but different User-Agent strings, each requesting a unique URL path that doesn't exist. Additionally, the network capture shows that the requests are coming from a botnet. Which conclusion is most supported by the evidence?

The requests are part of a DDoS attack designed to overwhelm the server.

The requests are likely from a vulnerability scanner that is part of a botnet, attempting to identify exploitable services.

The requests are from a misconfigured web crawler that is stuck in a loop.

The requests are from a legitimate user who is using multiple browsers and visiting non-existent pages.

A web application was compromised via a remote code execution (RCE) vulnerability. The investigator has access to the application's source code. Which code pattern would most likely be the root cause of the RCE?

The application passes user-supplied input directly to a system command execution function without sanitization.

The application uses HTTPS for all communications.

The application uses prepared statements for database queries.

The application stores passwords in plaintext in the database.

What is the primary purpose of analyzing web server error logs during an investigation?

To recover deleted files from the server

To identify failed requests that may indicate scanning or exploitation attempts

To determine the physical location of the server

To measure the server's performance

EC-CouncilComputer Hacking Forensic Investigator

Domain 5Objective 1

Investigating Web Attacks CHFI Practice Questions (Page 7)

Part of the Web and Dark Web Forensics domain, which makes up ~13% of our current practice bank.

48questions here

10free pages

8concepts

Questions 31–35

31foundation · easy
Which of the following is a common web attack vector that a forensic investigator should be familiar with?
Select an answer first
32expert · hard
A security analyst is investigating a web attack. The web server logs show a series of requests with the same source IP but different User-Agent strings, each requesting a unique URL path that doesn't exist. Additionally, the network capture shows that the requests are coming from a botnet. Which conclusion is most supported by the evidence?
Select an answer first
33application · medium
A web application was compromised via a remote code execution (RCE) vulnerability. The investigator has access to the application's source code. Which code pattern would most likely be the root cause of the RCE?
Select an answer first
34foundation · easy
What is the primary purpose of analyzing web server error logs during an investigation?
Select an answer first
35foundation · easy
Which HTTP header can provide additional information about the client's origin, but may be unreliable due to spoofing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

Investigating Web Attacks CHFI Practice Questions (Page 7)

Questions 31–35

Which of the following is a common web attack vector that a forensic investigator should be familiar with?

A web application was compromised via a remote code execution (RCE) vulnerability. The investigator has access to the application's source code. Which code pattern would most likely be the root cause of the RCE?

What is the primary purpose of analyzing web server error logs during an investigation?

Which HTTP header can provide additional information about the client's origin, but may be unreliable due to spoofing?

Keep studying — Web and Dark Web Forensics