Digital Forensics Quiz

In Windows forensics, which log type would most likely reveal evidence of privilege escalation attempts?

• Application Log

• Security Log

• Setup Log

• Forwarded Events

An investigator detects unusual SSH login attempts on a Linux server. Which command provides the most targeted view of authentication-related events?

• cat /var/log/messages

• journalctl -u sshd

• less /var/log/syslog

• dmesg

Which log correlation scenario provides the strongest indication of a web server compromise?

• Apache access.log shows multiple 404 errors from the same IP.

• Apache error.log shows repeated PHP warnings.

• Firewall logs show denied outbound traffic.

• Apache access.log indicates a SQL injection payload followed by a database error in MySQL logs.

In the digital forensic workflow, why is hashing (MD5/SHA-256) applied immediately after evidence acquisition?

• To compress evidence for storage efficiency.

• To prove evidence integrity throughout investigation.

• To encrypt the evidence against attackers.

• To anonymize sensitive data during analysis.

Which forensic artifact from the Windows Registry is most useful to confirm that a specific USB device was used for data exfiltration?

• NTUSER.DAT RecentDocs

• SYSTEM\MountedDevices

• SYSTEM\CurrentControlSet\Enum\USBSTOR

• SAM hive

During vulnerability assessment, a team discovers HTTP PUT enabled on a production server. What is the most critical risk this configuration introduces?

• Unauthorized data deletion

• Upload of malicious files such as web shells

• Brute-force login attacks

• Misconfigured TLS certificates

Which log management tool is best suited for real-time detection of insider threats by correlating user login anomalies across multiple systems?

• Autopsy

• Splunk

• FTK Imager

• Nikto

A forensic analyst wants to reconstruct user browsing history after evidence of a malware infection. Which combination of tools and logs is most effective?

• FTK + Prefetch files

• Autopsy + Apache error.log

• EnCase + Browser cache/History

• Wireshark + /var/log/messages

Why is integrating NetFlow analysis with log systems considered more effective in detecting exfiltration attempts?

• It captures application-level payloads.

• It shows detailed MAC addresses of devices.

• It highlights unusual long-duration or large data flows leaving the network.

• It automatically prevents outbound connections.

Which OWASP Top 10 vulnerability directly exploits insufficient logging and monitoring as a weakness?

• SQL Injection

• Broken Authentication

• Insufficient Logging & Monitoring

• Sensitive Data Exposure