Investigating Web Attacks CHFI Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A web server's access log shows a series of requests that appear to be a SQL injection attack, but the web application uses parameterized queries. The network capture shows the same requests, but the application log shows no errors or unusual behavior. Which conclusion is best supported?

   • AThe network capture proves the attack was successful because the requests were sent.
   • BThe access log is the only reliable source, so the attack must have occurred.
   • CThe requests are likely a false positive or a scan, because the application is not vulnerable to SQL injection.
   • DThe SQL injection attack succeeded despite parameterized queries.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A forensic team is investigating a web attack that involved a drive-by download. The compromised user's machine has been powered off, and the investigator needs to recover evidence of the malicious script execution. Which of the following artifacts would be most valuable to recover from the machine's disk?

   • AThe pagefile.sys, which may contain fragments of the malicious script from memory.
   • BThe Windows event logs, which record all process executions and network connections.
   • CThe system's hibernation file, which contains a full memory dump of the last session.
   • DThe browser's cache and temporary internet files, which may contain the malicious script or the downloaded payload.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   An investigator is correlating network captures with web server logs to trace a web attack. Which finding would best confirm that a request seen in the network capture actually reached the web application?

   • AThe network capture shows a TCP handshake with the server's IP address.
   • BThe web server access log contains an entry with the same timestamp and source IP as the network capture.
   • CThe network capture shows the request being sent to the correct destination port 80.
   • DThe network capture shows a large number of packets in the conversation.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   An investigator is writing a forensic report for a web attack. The report includes a timeline of events, but the investigator is unsure whether to include the raw log excerpts. What is the best practice?

   • AInclude relevant raw log excerpts as appendices to support the timeline and conclusions.
   • BInclude the logs only if they are from the primary server, not from proxies or firewalls.
   • COnly include a summary of the logs to keep the report concise.
   • DExclude raw logs because they are too technical for non-technical readers.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An investigator is reviewing web application source code after a file upload attack. Which code pattern is most likely the vulnerability that allowed the attack?

   • AThe upload script renames the file to a random name with a .txt extension.
   • BThe upload script only checks the Content-Type header provided by the client.
   • CThe upload script checks the file extension against a whitelist of allowed types.
   • DThe upload script stores files in a directory outside the web root.
   Reveal Solution Discussion Select an answer first