CCD Log Analysis & Forensics 3 — Questions and Answers
Question 1: An analyst reviews Apache access logs and sees repeated requests for '/../../../etc/passwd'. What attack is being attempted?
- SQL injection
- Directory traversal (Correct answer)
- XML external entity injection
- Server-side request forgery
Correct answer: Directory traversal
Sequences of '../' in URLs are the signature pattern of directory traversal attacks attempting to read files outside the web root.
Question 2: In network forensics, what does a high volume of DNS TXT record queries to a single external domain suggest?
- Normal SPF validation activity
- DNS-based data exfiltration (DNS tunneling) (Correct answer)
- DoH (DNS over HTTPS) misconfiguration
- Legitimate CDN health checks
Correct answer: DNS-based data exfiltration (DNS tunneling)
Unusually high DNS TXT queries—especially with encoded or high-entropy subdomains—are a primary indicator of DNS tunneling used for C2 or data exfiltration.
Question 3: Which chain-of-custody principle ensures that digital evidence remains admissible in court?
- Evidence must be collected by law enforcement only
- A documented, unbroken record of evidence handling from collection to presentation (Correct answer)
- Evidence must be stored on write-protected media exclusively
- Only hash verification is required for admissibility
Correct answer: A documented, unbroken record of evidence handling from collection to presentation
An unbroken chain of custody documents every person who handled the evidence, preventing claims of tampering and ensuring legal admissibility.
Question 4: During log analysis you notice an internal host making outbound connections on port 443 to 10 different external IPs every 30 minutes. What C2 technique does this resemble?
- Fast-flux DNS
- Beaconing (Correct answer)
- Domain generation algorithm (DGA)
- SMB lateral movement
Correct answer: Beaconing
Regular, periodic outbound connections from a compromised host to external IPs is the defining characteristic of C2 beaconing.
Question 5: What tool is commonly used on Linux to capture and analyze raw network packets during a live forensic investigation?
- Volatility
- tcpdump (Correct answer)
- Autopsy
- Logwatch
Correct answer: tcpdump
tcpdump is a command-line packet analyzer used to capture and inspect raw network traffic in real time on Linux systems.
Question 6: An IDS alert shows a large number of SYN packets sent to sequential port numbers (1-1024) from a single source. What activity does this indicate?
- DDoS amplification
- TCP SYN flood
- Port scanning (TCP SYN scan) (Correct answer)
- BGP route injection
Correct answer: Port scanning (TCP SYN scan)
Sequential SYN packets to many ports with no completed handshakes is the signature of a TCP SYN (half-open) port scan used in reconnaissance.
Question 7: Which Windows registry hive would a forensic analyst examine to find evidence of USB devices that were previously connected to a system?
- HKLM\SYSTEM\CurrentControlSet\Services
- HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR (Correct answer)
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Correct answer: HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
The USBSTOR key under SYSTEM\CurrentControlSet\Enum records all USB storage devices that have ever been plugged into the system.
CCD Log Analysis & Forensics 3
An analyst reviews Apache access logs and sees repeated requests for '/../../../etc/passwd'.
What attack is being attempted?