NEW
Font size
WorksheetsDigital Forensics Quiz
Total questions: 20
Worksheet time: 10mins
In Windows forensics, which log type would most likely reveal evidence of privilege escalation attempts?
Application Log
Security Log
Setup Log
Forwarded Events
An investigator detects unusual SSH login attempts on a Linux server. Which command provides the most targeted view of authentication-related events?
cat /var/log/messages
journalctl -u sshd
less /var/log/syslog
dmesg
Which log correlation scenario provides the strongest indication of a web server compromise?
Apache access.log shows multiple 404 errors from the same IP.
Apache error.log shows repeated PHP warnings.
Firewall logs show denied outbound traffic.
Apache access.log indicates a SQL injection payload followed by a database error in MySQL logs.
In the digital forensic workflow, why is hashing (MD5/SHA-256) applied immediately after evidence acquisition?
To compress evidence for storage efficiency.
To prove evidence integrity throughout investigation.
To encrypt the evidence against attackers.
To anonymize sensitive data during analysis.
Which forensic artifact from the Windows Registry is most useful to confirm that a specific USB device was used for data exfiltration?
NTUSER.DAT RecentDocs
SYSTEM\MountedDevices
SYSTEM\CurrentControlSet\Enum\USBSTOR
SAM hive
During vulnerability assessment, a team discovers HTTP PUT enabled on a production server. What is the most critical risk this configuration introduces?
Unauthorized data deletion
Upload of malicious files such as web shells
Brute-force login attacks
Misconfigured TLS certificates
Which log management tool is best suited for real-time detection of insider threats by correlating user login anomalies across multiple systems?
Autopsy
Splunk
FTK Imager
Nikto
A forensic analyst wants to reconstruct user browsing history after evidence of a malware infection. Which combination of tools and logs is most effective?
FTK + Prefetch files
Autopsy + Apache error.log
EnCase + Browser cache/History
Wireshark + /var/log/messages
Why is integrating NetFlow analysis with log systems considered more effective in detecting exfiltration attempts?
It captures application-level payloads.
It shows detailed MAC addresses of devices.
It highlights unusual long-duration or large data flows leaving the network.
It automatically prevents outbound connections.
Which OWASP Top 10 vulnerability directly exploits insufficient logging and monitoring as a weakness?
SQL Injection
Broken Authentication
Insufficient Logging & Monitoring
Sensitive Data Exposure
In Linux forensics, /var/log/kern.log is particularly valuable for investigating:
Privilege escalation attempts
File access patterns
Hardware failures and kernel-level errors
Web application vulnerabilities
Which forensic principle ensures that every interaction with digital evidence is traceable and defensible in court?
Non-repudiation
Chain of Custody
Data Retention
Least Privilege
In vulnerability assessment, Nessus is particularly valuable for:
Packet reconstruction and malware traffic analysis
Deep inspection of running processes in memory
Compliance auditing and CVSS-based risk prioritization
Discovering logical flaws in custom applications
Which of the following best demonstrates Locard’s Principle of Exchange in digital forensics?
A USBSTOR registry entry revealing a connected device
An IDS alert with a false positive
A SIEM dashboard highlighting aggregated logs
A system reboot log entry after patching
Which scenario best illustrates the limitation of automated vulnerability scanners like OpenVAS?
Missing detection of outdated Apache versions
Failing to identify complex authentication bypass flaws
False positives due to outdated signature database
Both b and c
Which forensic suite is most widely accepted in legal proceedings due to its emphasis on evidence integrity and admissibility?
Autopsy
FTK
EnCase
Volatility
During incident response, an investigator finds an unusual outbound connection to an unknown IP at midnight. Which combination of tools/logs provides the most reliable evidence of data exfiltration?
Firewall logs + NetFlow analysis
Registry Run key + Prefetch
Auth.log + Apache access.log
IDS logs + Setup logs
Which HTTP method poses the greatest server-side security risk if misconfigured?
HEAD
GET
PUT
OPTIONS
Which forensic artifact is the best source of evidence to prove that a suspect intentionally accessed a confidential document even after deletion?
ShellBags
Prefetch files
Slack space analysis
RecentDocs MRU
Why is SIEM integration critical in modern log management?
It ensures only text-based logs are stored.
It eliminates the need for forensic tools.
It automates correlation and real-time detection of advanced persistent threats (APTs).
It guarantees 100% removal of false positives.
