Investigating Web Attacks CHFI Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   During a web attack investigation, an investigator needs to preserve potential evidence from a compromised web server. Which action best preserves volatile and non-volatile artifacts in a forensically sound manner?

   • ACopy the web server logs and configuration files to a USB drive, then shut down the server.
   • BImmediately power off the server to prevent further changes, then image the hard drive.
   • CCapture a memory dump first, then create a bit-for-bit image of the hard drive using a write blocker.
   • DRun the web server's backup script to create a full backup of the website files.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An investigator has completed the analysis of a web attack and must write the forensic report. Which element is most important for the report to be admissible in court?

   • AA summary of the investigator's conclusions and recommended remediation steps.
   • BA detailed timeline of events with timestamps from the web server logs and network captures.
   • CA clear chain of custody documenting every person who handled the evidence and when.
   • DA list of all software tools used during the investigation, with their version numbers.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   During a web attack investigation, an analyst finds a suspicious outbound connection from the web server to an IP address that is not in the server's allowed list. The connection occurred at 2:00 AM. The web server's access log shows no corresponding inbound request. Which additional data source would be most useful to determine if the outbound connection was initiated by a compromised process?

   • AThe server's event logs for user logon events.
   • BThe server's DNS logs to see what domain the IP resolved to.
   • CThe server's process execution logs (e.g., Sysmon or auditd) to see which process made the connection.
   • DThe server's firewall logs to see if the outbound connection was blocked.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An investigator is analyzing a web server's access log to reconstruct an attack. Which log entry pattern is most indicative of a directory traversal attempt?

   • AA request for /index.php with a very long User-Agent string.
   • BA request for /etc/passwd using the URL /../../../../etc/passwd.
   • CA request for /product.php?id=1 OR 1=1.
   • DMultiple requests for /admin/login.php from different IP addresses.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   An investigator is examining web application code after a data breach. The application uses an ORM (Object-Relational Mapping) framework. The access log shows SQL injection-like patterns, but the ORM is supposed to prevent SQL injection. Which code pattern would explain the apparent SQL injection?

   • AThe application uses an older version of the ORM that has known vulnerabilities.
   • BThe application uses the ORM's parameterized query methods for all database access.
   • CThe application uses the ORM's query builder with user input passed as a parameter.
   • DThe application uses raw SQL queries through the ORM's 'query()' method with string concatenation.
   Reveal Solution Discussion Select an answer first