A web server was compromised via a drive-by download. You have a memory dump from the server. Which memory artifact would be most indicative of a drive-by download attack?

A browser process with injected code and network connections to a malicious domain

The web server process containing a large number of HTTP requests

The system registry showing a new service entry

The page file containing fragments of a downloaded file

Which piece of information is most useful for correlating a web server log entry with a network packet capture?

Timestamp and source IP address

You are investigating a web attack where the attacker used a previously unknown exploit to gain code execution on the web server. You have a memory dump taken after the attack. Which memory forensics technique would be most effective in identifying the exploit code?

Compare the memory dump to a known-good baseline to identify anomalies

Check the browser history on the server

Analyze the page file for remnants of the exploit

Scan the memory dump for strings and patterns related to the exploit, such as shellcode signatures or unusual API calls

EC-CouncilCertified Security Specialist

Domain 6Objective 4

Investigating Web Attacks ECSS Practice Questions (Page 5)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

53questions here

11free pages

9concepts

Questions 21–25

21expert · hard
A web server was compromised via a drive-by download. You have a memory dump from the server. Which memory artifact would be most indicative of a drive-by download attack?
Select an answer first
22foundation · easy
Which piece of information is most useful for correlating a web server log entry with a network packet capture?
Select an answer first
23application · medium
You are writing a forensic report for a web attack that involved SQL injection and data exfiltration. The report will be reviewed by both legal counsel and IT management. Which section should include the raw SQL injection payloads?
Select an answer first
24foundation · easy
In a systematic web attack methodology, which phase typically follows reconnaissance and involves actively probing the target for vulnerabilities?
Select an answer first
25expert · hard
You are investigating a web attack where the attacker used a previously unknown exploit to gain code execution on the web server. You have a memory dump taken after the attack. Which memory forensics technique would be most effective in identifying the exploit code?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Investigating Web Attacks ECSS Practice Questions (Page 5)

Questions 21–25

A web server was compromised via a drive-by download. You have a memory dump from the server. Which memory artifact would be most indicative of a drive-by download attack?

Which piece of information is most useful for correlating a web server log entry with a network packet capture?

You are writing a forensic report for a web attack that involved SQL injection and data exfiltration. The report will be reviewed by both legal counsel and IT management. Which section should include the raw SQL injection payloads?

In a systematic web attack methodology, which phase typically follows reconnaissance and involves actively probing the target for vulnerabilities?

You are investigating a web attack where the attacker used a previously unknown exploit to gain code execution on the web server. You have a memory dump taken after the attack. Which memory forensics technique would be most effective in identifying the exploit code?

Keep studying — Digital Forensics Investigations