ECCouncil Updated 312-49v11 Exam Questions and Answers by dennis

Option B. PyTSK is the best answer because the question specifically asks for a Python-based tool that integrates with The Sleuth Kit (TSK) to examine a disk image and access its files and directories. CHFI v11 explicitly includes Windows and Linux Forensics using Python , Python Digital Forensics Basics , and File System Analysis Using Autopsy and The Sleuth Kit (TSK) .

PyTSK is the Python binding or interface commonly used to work with Sleuth Kit functionality programmatically. That makes it the most natural answer when the task involves Python-based analysis of image contents. FTK Imager and Autopsy are important forensic tools, but they are not the specific Python-based interface described. py.apipkg does not fit the forensic image-analysis role being tested here.

Because the question combines Python with Sleuth Kit-based disk image access , the answer most consistent with CHFI’s Python and file-system-analysis objectives is PyTSK . It allows investigators to script file and directory examination in a structured, repeatable forensic workflow.

The correct answer is C because the Apache access log is the single evidentiary source that can tie together the request details and the server’s response outcome in one timestamped record. The question requires two things from one place: recovering the attacker-supplied payload and confirming how the server responded. A query string may contain the encoded XML payload, but by itself it does not provide the full evidentiary context such as status code, request timing, source host, and request line. A 200 status code is only one field, not a source. A GET request is a request method, not the artifact repository. Apache access logs routinely record the request line, which can include the query string, along with the response status code and related metadata. That makes them ideal for reconstructing both what the attacker sent and how the server processed it, while keeping timestamps aligned within the same record. In CHFI v11, web application forensics depends heavily on interpreting web server logs to investigate malicious requests, making the Apache access log the strongest answer here.

According to the CHFI v11 objectives under Web Application Forensics and Log Analysis , knowing the default storage locations of web server logs is essential for reconstructing web-based attacks. On Windows Server operating systems, Internet Information Services (IIS) stores its HTTP and HTTPS request logs by default in the directory:

%SystemDrive%\inetpub\logs\LogFiles

This directory contains subfolders such as W3SVC1, W3SVC2, etc., where each folder corresponds to a specific IIS website instance. The log files stored here record critical forensic details including client IP addresses, timestamps, HTTP methods, requested URLs, status codes, user agents, and referrers . These artifacts allow investigators to identify attack vectors such as SQL injection, command injection, directory traversal, brute-force attempts, and web shell uploads.

The other options are incorrect because they do not represent default IIS log locations. %AppData% is user-profile specific, %ProgramFiles% contains application binaries rather than logs, and %SystemRoot%\Logs\IIS is not a standard IIS logging path.

The CHFI Exam Blueprint v4 explicitly covers IIS web server architecture and log analysis , emphasizing familiarity with default log paths to ensure timely evidence acquisition and accurate incident reconstruction. Therefore, %SystemDrive%\inetpub\logs\LogFiles is the correct and exam-aligned answer

Option B. Dictionary attack is the best answer because the attacker used a precompiled list of common passwords and tested them against the login page. That is the defining pattern of a dictionary attack: trying likely password candidates from a prepared wordlist rather than exhaustively attempting every possible combination. CHFI v11 includes password-related attack and analysis concepts within its investigation scope, and this scenario matches the classic distinction between dictionary and brute-force methods.

A brute-force attack would attempt all possible character combinations systematically, which is broader and usually more time-consuming than using a list of common passwords. A keylogger would capture keystrokes from the victim’s device, which is not what happened here. Cryptanalytic attack refers to attacking cryptographic mechanisms, not simply testing common passwords against a login page.

From a CHFI perspective, understanding the difference between password-guessing methods is important because it helps investigators interpret authentication logs and attacker behavior. Since Oliver relied on a text file of frequently used passwords and tested them one by one, the technique most accurately described is a dictionary attack .