An analyst finds a web server log entry for a suspicious request at 10:00:00 and a database log entry showing a large data export at 10:00:05. What does this correlation suggest?

The database export caused the web request

The events are unrelated and coincidental

The suspicious request likely triggered the database export

An analyst notices that a login request to `https://example.com/login` includes a `Cookie: sessionid=attacker_controlled` header before authentication. After successful login, the server responds with `Set-Cookie: sessionid=attacker_controlled`. What attack is this?

Session fixation, because the attacker sets the session ID before authentication and the server accepts it.

Session hijacking, because the attacker stole the session ID from the user.

A normal login flow, because the client can choose its own session ID.

Cross-site request forgery (CSRF), because the attacker is forging login requests.

EC-CouncilDigital Forensics Essentials

Domain 5Objective 4

Web Application Forensics DFE Practice Questions (Page 9)

Part of the Network and Web Attack Forensics domain, which makes up ~15% of our current practice bank.

45questions here

9free pages

10concepts

Questions 41–45

41foundation · easy
Which attack involves an attacker setting a user's session ID to a known value before the user logs in, allowing the attacker to hijack the session after authentication?
Select an answer first
42foundation · easy
Which tool is specifically designed to analyze web server log files and generate reports on visitor behavior and potential security issues?
Select an answer first
43foundation · easy
An analyst finds a web server log entry for a suspicious request at 10:00:00 and a database log entry showing a large data export at 10:00:05. What does this correlation suggest?
Select an answer first
44application · medium
An analyst notices that a login request to `https://example.com/login` includes a `Cookie: sessionid=attacker_controlled` header before authentication. After successful login, the server responds with `Set-Cookie: sessionid=attacker_controlled`. What attack is this?
Select an answer first
45foundation · easy
Which tool is commonly used to intercept and modify HTTP requests and responses between a browser and a web application for forensic analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Web Application Forensics DFE Practice Questions (Page 9)

Questions 41–45

Which attack involves an attacker setting a user's session ID to a known value before the user logs in, allowing the attacker to hijack the session after authentication?

Which tool is specifically designed to analyze web server log files and generate reports on visitor behavior and potential security issues?

An analyst finds a web server log entry for a suspicious request at 10:00:00 and a database log entry showing a large data export at 10:00:05. What does this correlation suggest?

An analyst notices that a login request to `https://example.com/login` includes a `Cookie: sessionid=attacker_controlled` header before authentication. After successful login, the server responds with `Set-Cookie: sessionid=attacker_controlled`. What attack is this?

Which tool is commonly used to intercept and modify HTTP requests and responses between a browser and a web application for forensic analysis?

Keep studying — Network and Web Attack Forensics